PaperCut NG/MF Cross-Site Request Forgery Vulnerability

漏洞信息

漏洞名称： PaperCut NG/MF Cross-Site Request Forgery Vulnerability

漏洞编号：

• CVE： CVE-2023-2533

漏洞类型： 跨站请求伪造

漏洞等级： 高危

漏洞描述： PaperCut NG/MF是一款广泛使用的打印管理软件，主要部署在企业环境中，用于管理打印任务、用户权限和打印成本等。由于其广泛的应用，该软件的漏洞可能影响到大量企业和机构。CVE-2023-2533是一个严重的跨站请求伪造（CSRF）漏洞，影响版本包括22.0.10及之前的所有版本。该漏洞的技术根源在于软件未能充分验证来自用户浏览器的请求，导致攻击者可以通过构造恶意网页，诱骗已认证的管理员在不知情的情况下执行恶意操作。由于漏洞利用需要管理员在活跃会话中与恶意网页交互，因此攻击者需要一定的社会工程技巧来诱导管理员点击恶意链接。一旦成功利用，攻击者可以远程执行代码（RCE），完全控制受影响的系统，导致数据泄露、服务中断或其他恶意操作。为了防范此类攻击，建议管理员及时升级到最新版本，实施强化的CSRF防护措施，并对管理员进行安全意识培训，以识别和避免潜在的钓鱼攻击。

产品厂商： PaperCut

产品名称： PaperCut NG/MF

影响版本： <= 22.0.10 (Build 65996)

来源： https://github.com/allinsthon/CVE-2023-2533

类型： CVE-2023:github search

仓库文件

• README.md

来源概述

CVE-2023-2533 PaperCut NG/MF Exploit

Overview

CVE-2023-2533 is a critical Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF print management software, affecting versions up to and including 22.0.10. This exploit enables remote code execution (RCE) by tricking an authenticated administrator into interacting with a malicious webpage during an active session in the PaperCut admin interface.

CVSSv3 Score: 8.8
Patched: June 9, 2023
Affected Versions: <= 22.0.10 (Build 65996)

Note: This exploit is fully functional and has been tested in controlled environments. Use it responsibly and only on systems where you have explicit permission.

Requirements

• Python 3.8 or higher
• Access to a vulnerable PaperCut NG/MF server (version <= 22.0.10)
• An active admin session on the target server

Setup

1. Install dependencies:

   pip install -r requirements.txt

2. Update the target server URL in exploit.py (e.g., http://papercut-server:9191).
3. (Optional) Customize the payload in the payloads/ directory to suit your needs.

Exploit

href

Usage

1. Launch the exploit server:

   python3 exploit.py

2. The server hosts a malicious page at http://<your-ip>:5000/exploit.html.
3. Deliver the URL to an admin.
4. When the admin visits the page, the exploit automatically sends forged requests.
5. Monitor the server logs for confirmation of successful execution.

Payloads

The payloads/ directory includes pre-built payloads for various operating systems.
You can replace these with your own payloads as needed.

Detection and Mitigation

• Detection: Look for unusual admin activity in server logs, such as unexpected file uploads or configuration changes.
• Mitigation: Upgrade PaperCut NG/MF to the latest version as per the official advisory. Implement robust CSRF protections and train admins to recognize phishing attempts.

Disclaimer

This exploit is provided for educational and testing purposes only. Unauthorized use against systems without explicit permission is illegal and unethical. The author is not responsible for any damage or misuse of this tool.