More information has emerged about how criminals are using a recently discovered security flaw in PaperCut. This appeared to use unobtrusive office printers to break into corporate networks.
According to a new report on beep computer cybercriminals are using two flaws in popular print (opens in new tab) Management software for delivering Atera remote management software to vulnerable endpoints. Such software gives the attacker complete control over the target device.
We’ve also obtained two proofs of concept (PoCs) that show exactly how the vulnerability could be exploited, dramatically increasing its destructive potential. The first PoC was released by Horizon3, an attack surface evaluation company. The exploit is described as “abusing the printer’s built-in ‘scripting’ functionality to allow remote code execution.”
few targets Managed cybersecurity platform provider Huntress also presented a PoC, but only in the form of a video demo. His actual PoC has not yet been published.
Citing data from a Shodan search, BleepingComputer offers a silver lining that there are only about 1,700 publicly exposed PaperCut servers that attackers can target. Still, even one successful attack is too many for him.
However, there are patches and workarounds for the flaws, so users are encouraged to address the issue immediately to minimize potential risk. .11 (MF), and 22.0.9 (NG) patches should be applied.
The second flaw can also be mitigated by enforcing “allow list” restrictions. Options > Advanced Settings > Security > Allowed Site Server IP Addresses only allow verified Site Server IP addresses to access the network.
PaperCut says it’s impossible to determine with absolute certainty whether a threat actor has compromised a network, so anyone interested in double-checking whether a system has been compromised is out of luck.
The developer suggested that the IT team look for suspicious activity in the PaperCut admin interface below. Logs > Application Log containing updates from a user called [setup wizard]You can also look for new users being created and configuration key changes.
Via: BleepingComputer (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings