# MA-966.082023: MyCERT Advisory - CVE-2023-39143 - PaperCut Path Traversal/File Upload RCE Vulnerability

**Date:** 23 Aug 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-966.082023  
**Advisory ID:** MA-966.082023

---

**1.0 Introduction**
CVE-2023-39143 is a critical security vulnerability that has been identified in the PaperCut NG/MF print management software. This vulnerability could potentially lead to remote code execution and is a result of unauthenticated attackers exploiting path traversal and file upload weaknesses. This advisory provides a general overview of CVE-2023-39143 and its implications. It is crucial for organizations using PaperCut NG/MF to review the official July 2023 PaperCut security bulletin for comprehensive information and to follow the recommended actions for ensuring the security of their systems.
**2.0 Impact**
This vulnerability allows unauthenticated attackers to exploit path traversal and file upload vulnerabilities to potentially read, delete, and upload arbitrary files to the PaperCut MF/NG application server. Successful exploitation of this vulnerability could result in remote code execution, especially in configurations where external device integration settings are enabled. PaperCut servers running on Windows with this setting turned on are particularly susceptible.
Threat actors have already demonstrated interest in targeting PaperCut servers. Earlier campaigns have exploited CVE-2023-27350, a previously disclosed unauthenticated remote code execution vulnerability. Unlike CVE-2023-27350, CVE-2023-39143 does not require attackers to possess prior privileges or engage with users. The exploitation of this vulnerability is more complex, involving the chaining of multiple issues rather than being a straightforward "one-shot" remote code execution exploit.
**3.0 Affected Products**
All PaperCut NG and MF versions prior to 22.1.3 on Windows platforms only (excluding fixed versions named below).
**4.0 Incidicators of Compromise (IoC)**
A simple command can help identify if a PaperCut server is vulnerable and running on Windows:
| --- | curl -w "%{http\_code}" -k --path-as-is "https://<IP>:<port>/custom-report-example/..\..\..\deployment\sharp\icons\home-app.png" |
A 200 response indicates an unpatched server running on Windows, while a 404 response suggests a patched server or a system not running on Windows.
**5.0 Recommendations**
The recommended course of action is to upgrade to the latest version of PaperCut NG/MF, which is 22.1.3 at the time of writing. Upgrading will effectively mitigate the vulnerability. Please refer to the following URL for upgrades:
<https://www.papercut.com/products/upgrade/>
If an immediate upgrade is not feasible, administrators can implement temporary mitigation by configuring an allowlist of device IP addresses permitted to communicate with the PaperCut server. For detailed guidance, please refer to the "IP Address Allow-listing" section of the PaperCut security best practices guide at the following URL: <https://www.papercut.com/kb/Main/SecureYourPaperCutServer/>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
1. <https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/>
2. <https://www.papercut.com/kb/Main/securitybulletinjuly2023/>
3. <https://www.helpnetsecurity.com/2023/08/07/cve-2023-39143/>