CVE-2024-1654: PaperCut MF RCE Vulnerability

CVE-2024-1654 Overview

CVE-2024-1654 affects PaperCut MF and PaperCut NG print management software. The vulnerability allows unauthorized write operations that may lead to remote code execution (RCE). Exploitation requires an authenticated administrator, knowledge of an internal system identifier, and details of another valid user. The flaw is classified under [CWE-183] (Permissive List of Allowed Inputs) and impacts deployments on Windows, macOS, and Linux hosts.

Critical Impact
An authenticated administrator with sufficient knowledge of internal identifiers can perform unauthorized writes on the PaperCut server, potentially achieving remote code execution with the privileges of the PaperCut service account.

Affected Products

PaperCut MF (all versions prior to the March 2024 security bulletin fix)
PaperCut NG (all versions prior to the March 2024 security bulletin fix)
Deployments on Microsoft Windows, Apple macOS, and Linux kernel platforms

Discovery Timeline

2024-03-14 - CVE-2024-1654 published to NVD
March 2024 - PaperCut releases security patch via the PaperCut Security Bulletin March 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1654

Vulnerability Analysis

The vulnerability resides in a code path that accepts inputs matching a permissive allowlist ([CWE-183]). PaperCut MF and NG expose administrative functionality that trusts certain identifiers without adequate validation. When an authenticated administrator supplies specific parameters, the server processes write operations that should be restricted. These writes can be steered against configuration or executable content, providing a route to code execution under the PaperCut Application Server process.

The attack surface is network-reachable via the PaperCut admin interface. Prerequisites raise the exploitation bar: attackers must already hold admin credentials and know an internal system identifier plus attributes of another valid user account. This constrains opportunistic abuse but does not prevent attacks that follow credential theft, insider misuse, or chained exploitation of prior admin-access vulnerabilities.

Root Cause

The root cause is improper enforcement of allowed inputs within an administrative write handler. Insufficient validation of internal identifiers and user references allows an authenticated administrator to trigger write operations outside their intended scope. Because the PaperCut server processes these writes with service-level privileges, the flaw crosses from an authorization gap into a code-execution risk.

Attack Vector

Exploitation follows the network attack vector against the PaperCut admin service. The attacker authenticates as an administrator, then submits crafted administrative requests that reference an internal identifier and another valid user. The server performs the unauthorized write, which the attacker uses to plant or modify content executed by the PaperCut process. Successful exploitation compromises confidentiality, integrity, and availability of the PaperCut host. No verified public proof-of-concept is available at this time; see the PaperCut Security Bulletin March 2024 for vendor guidance.

Detection Methods for CVE-2024-1654

Indicators of Compromise

Unexpected administrator sessions or logins to the PaperCut admin console from unusual source IPs or outside business hours
New or modified files under the PaperCut installation directory ([app-path]/server/, [app-path]/providers/) that do not correspond to a known upgrade or patch
Child processes spawned by the PaperCut Application Server (for example pc-app.exe on Windows or app-server on Linux) that launch shells, scripting engines, or LOLBins
Outbound network connections from the PaperCut host to unfamiliar external addresses shortly after admin activity

Detection Strategies

Monitor PaperCut server.log and admin audit logs for administrative write operations that reference unusual internal identifiers or unexpected user records
Deploy endpoint detection tooling on the PaperCut server to identify anomalous process creation chains originating from the Application Server process
Correlate authentication events with subsequent administrative API calls to identify sessions that immediately perform write-heavy admin actions

Monitoring Recommendations

Alert on modifications to PaperCut binaries, scripts, and configuration files outside of vendor-approved change windows
Track admin console access with source IP, user agent, and session duration; investigate deviations from established baselines
Forward PaperCut logs to a centralized SIEM or data lake for retention and cross-source correlation with identity and network telemetry

How to Mitigate CVE-2024-1654

Immediate Actions Required

Apply the PaperCut MF or PaperCut NG update referenced in the PaperCut Security Bulletin March 2024 to all affected servers
Rotate administrator credentials for the PaperCut Application Server and enforce multi-factor authentication where supported
Review admin account inventory and remove unused or dormant administrative accounts
Audit recent administrative activity for write operations that match the exploitation pattern described in the vendor advisory

Patch Information

PaperCut released fixed versions of PaperCut MF and PaperCut NG as documented in the March 2024 security bulletin. Administrators should consult the vendor advisory for the exact fixed build numbers applicable to their release track and deploy the update on every PaperCut Application Server instance. Print providers and site servers should be updated according to PaperCut's upgrade guidance.

Workarounds

Restrict network access to the PaperCut admin interface (default TCP 9191/9192) to a limited management network or jump-host allowlist
Enforce IP-based restrictions on administrative logins using PaperCut's built-in Admin Rights configuration until the patch is applied
Increase logging verbosity on the PaperCut Application Server and forward logs off-host to preserve evidence in the event of exploitation

bash

# Example: restrict PaperCut admin interface to a management subnet on Linux (iptables)
iptables -A INPUT -p tcp --dport 9191 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9192 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP
iptables -A INPUT -p tcp --dport 9192 -j DROP