CVE-2024-3037 Arbitrary File Deletion in PaperCut NG/MF Web Print
An attacker with local low-privilege access can delete arbitrary files on Windows servers running PaperCut with Web Print enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3037?
CVE-2024-3037 is a high-severity path traversal vulnerability in PaperCut NG, PaperCut MF, published on 14 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server.
Important: In most installations, this risk is mitigated by the default Windows Server configuration, which typically restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log in to the local console of the Windows environment hosting the PaperCut NG/MF application server.
Note: This CVE has been split into two separate CVEs (CVE-2024-3037 and CVE-2024-8404) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users on the host server.
Which versions are affected by CVE-2024-3037?
It affects 2 products.
Products include Papercut Papercut Mf, Papercut Papercut Ng.
How do I fix CVE-2024-3037?
No fix has been published for CVE-2024-3037 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-3037 being exploited?
There is no known exploitation of CVE-2024-3037 in the wild and no public exploit code.
Other vulnerabilities in PaperCut NG, PaperCut MF
Sources
Also known as GHSA-f4jg-5wj8-pr9p.