Latest / The Digital Warfare Podcast / EP. 152: PaperCut NG/MF Zero-Day Exploited in Active Attacks
Transcript
- Digital Warfare: You're listening to the Digital Warfare podcast. Today, we are covering a zero-day attack where defenders are being asked to act before they even know exactly what the vulnerability is. The target is Papercut. The vendor has confirmed that attackers are actively exploiting an undisclosed vulnerability affecting Papercut NG and Papercut MF. Customer systems have already been compromised, and right now every version is potentially affected. The key issue is uncertainty. There is no publicly assigned CVE for this specific zero day. There is no published CVSS score, and Papercut has not yet disclosed exactly how attackers are gaining access. But the company has reproduced the vulnerability internally and says its emergency engineering team is developing and validating a code fix. Here's what we know. Papercut NG and Papercut MF are print management platforms used across businesses, universities, schools, and other organizations. The Papercut Application Server provides centralized control over users, printers, print jobs, and administrative functions. And some organizations make parts of that infrastructure accessible from the public internet. That exposure is now the immediate concern. Papercut's instruction is unusually direct. If your Papercut NG or MF application server can be reached from the public internet, restrict access to trusted IP addresses immediately. Use firewall rules, network access controls, or equivalent protections, and do it even if you have not detected suspicious activity. That last point matters, because the absence of obvious indicators does not mean the system is clean. Papercut has published several preliminary indicators defenders should investigate. One is suspicious post-exploitation activity originating from the Papercut application server process, pc-app.exe. Another is something defenders often overlook: logs disappearing. Papercut says missing, unexpectedly truncated or deleted server.log files may indicate compromise. That means an attacker may not simply be exploiting the application, they may also be attempting to remove evidence of what happened. Papercut has also identified two unusual error patterns in server logs. One references no suitable driver found for JDBC, no colon X, and another contains database error, looking up card ID, values cast. These entries should be treated as investigation leads. But Papercut makes an important warning. Their absence does not prove that a system was unaffected, and that changes how defenders should respond. This is not a situation where security teams should search for one indicator, fail to find it, and declare the server safe. Start with exposure. Was the papercut application server reachable from the internet? If yes, restrict that access now. Then preserve evidence. Collect logs before they disappear. Review endpoint detection telemetry around pc-app.exe. Look for unexpected child processes, unusual outbound connections, new persistence mechanisms. Unexpected account activity and administrative changes that do not correspond with legitimate operations. If suspicious activity is identified, treat the server as compromised and expand the investigation into connected systems and credentials. There is also important historical context. Papercut has been targeted before. In 2023, attackers exploited CVE-2023-27350, an authentication bypass vulnerability. That could ultimately enable remote code execution. The FBI and CISA documented exploitation by malicious actors, including ransomware activity, but today's incident should not automatically be assumed to involve that vulnerability. The current zero day remains undisclosed, attribution has not been established, and the vendor has not publicly described the complete exploitation chain. That distinction is important. Cybersecurity reporting becomes dangerous when uncertainty is converted into certainty simply because defenders want answers quickly. Right now, the correct response is containment first. Investigation second. Technical explanation when the evidence supports it. The strategic lesson is direct. Zero days create an uncomfortable security problem. Sometimes defenders must make decisions before a CVE exists, before a severity score exists, and before the attack chain has been fully explained. In those moments, exposure becomes intelligence. If a critical management system does not need to be accessible from the internet, do not wait for attackers to demonstrate why it shouldn't be. This has been your digital warfare daily brief. Stay secure. We'll see you tomorrow.