ExploitCVE-2024-8404
Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Summary
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. The vulnerability allows an attacker with local login access to the Windows Server hosting PaperCut NG/MF to execute low-privilege code directly on the server via the web-print-hot-folder. This could lead to unauthorized file deletion on the affected system. The vulnerability affects PaperCut NG and PaperCut MF versions prior to 23.0.9.
Impact
If exploited, this vulnerability could result in high impact on integrity, availability, and confidentiality of the affected system. An attacker could potentially delete critical files, leading to system instability, data loss, or service disruption. Sensitive information could also be compromised. The vulnerability has a CVSS base score of 7.8, indicating high severity. However, exploitation requires local access to the Windows Server hosting PaperCut NG/MF, which is typically restricted to administrators in default configurations.
Exploitation
One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. PaperCut has released version 23.0.9 for both PaperCut NG and PaperCut MF, which addresses this vulnerability. Security teams should prioritize updating to this version or later.
Mitigation
1. Update PaperCut NG and PaperCut MF to version 23.0.9 or later. 2. Ensure that local login access to the Windows Server hosting PaperCut NG/MF is restricted to administrators only. 3. If non-administrative users must have local login access, implement strict access controls and monitoring for the web-print-hot-folder. 4. Consider disabling Web Print functionality if it's not essential for operations. 5. Regularly audit user permissions and access to the PaperCut NG/MF server. 6. Implement and maintain robust logging and monitoring systems to detect any suspicious activities related to file operations in the affected areas.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-8404
A CVSS base score of 7.8 has been assigned.
Feedly found the first article mentioning CVE-2024-8404. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.6%)
The article does not provide specific details about the vulnerability CVE-2024-8404, including its criticality, CVSS score, exploitation in the wild, proof-of-concept exploits, mitigations, detections, or patches. It mentions that CVE-2024-8404 and CVE-2024-8405 are related vulnerabilities attributed to different reporters but lacks further context on their impact or downstream effects. Therefore, no additional information can be summarized regarding CVE-2024-8404 based on the provided content. See article
Detection for the vulnerability has been added to Nessus (209140)
Detection for the vulnerability has been added to Nessus (209141)