PaperCut has released emergency patches for its NG and MF print management software after security researchers confirmed that attackers are actively exploiting a previously unknown flaw to break into servers without needing a username or password. No CVE identifier had been assigned to the vulnerability as of publication.
PaperCut NG and MF are widely used by businesses, schools and government agencies to track and control network printing. That makes the software a common presence inside corporate networks, and a useful target for attackers looking for an initial foothold.
How the flaw works
According to technical analysis published by the incident response firm Huntress, the bug is an authorization bypass rooted in how PaperCut’s web application handles requests. A specially crafted request can point to one page for the purpose of rendering a response, while actually triggering an action that belongs to a different, more sensitive part of the software. Because the application checks permissions against the page being displayed rather than the component actually being invoked, an attacker with no valid login can still reach functions that should require administrator access.
Huntress said it was able to reproduce the full attack chain in a lab environment against a stock, unpatched copy of PaperCut NG. In real intrusions the firm investigated, attackers used the flaw to alter server configuration settings and ultimately get the PaperCut server to execute arbitrary Java code, delivered as hex-encoded “.class” files smuggled in through crafted requests.
What attackers did once inside
Huntress said it identified at least two confirmed customer incidents, one first observed around August 26 and a second the following day, each involving only a few minutes of hands-on activity. In both cases, the intruders ran basic reconnaissance commands, encoded in base64, that resolved to simple Windows commands checking the logged-in user, operating system version and running processes.
Investigators recovered malicious Java class files, named “Udydn.class” and “Moo97.class” in the incidents they examined, planted inside PaperCut’s own program directory. The files were used to run system commands and write the results to disk, after which the attackers deleted the output files, deleted or truncated the server’s log files, and removed their own tools, an apparent attempt to cover their tracks. Huntress also flagged unusual outbound network connections to attacker-controlled file shares as part of how the malicious code was staged.
SecurityWeek reported that roughly 1,000 PaperCut instances remain directly reachable from the public internet, most of them in North America and Europe, leaving a meaningful pool of potential targets exposed while patching catches up.
PaperCut’s response and what to do now
In a statement, PaperCut said: “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing.” The company has shipped emergency updates, including PaperCut NG 25.0.12.76497 and PaperCut MF 25.0.12.76496 for Windows, with a fix for version 24 still in development at the time of publication.
Huntress and other researchers are urging PaperCut administrators to apply the available patches immediately. Where patching cannot happen right away, the recommended stopgap is to take PaperCut application servers off the open internet entirely, placing them behind a VPN or restricting access to a short list of trusted IP addresses. Administrators are also encouraged to check for signs of compromise before and after patching, including missing or unexpectedly short server.log files, unfamiliar “.class” files inside the PaperCut installation folder, and unusual child processes spawned from the main PaperCut application process.
This is not the first time PaperCut software has been caught up in real-world attacks. At least three earlier PaperCut vulnerabilities already appear in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, reflecting a pattern of the software being targeted by intruders seeking a way into otherwise well-defended networks.
No CVE number, technical proof-of-concept, or attribution to a specific threat group had been publicly confirmed as of this writing. This article will be updated as PaperCut and researchers release more information.
Source: Huntress, “PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE”; additional reporting from SecurityWeek.
