PaperCut Print Software Hit by Actively Exploited Zero-Day

PaperCut has confirmed that attackers are actively exploiting a previously unknown vulnerability in its widely used print management software — PaperCut NG and PaperCut MF — and has released emergency patches. The company says it has verified incidents at customer sites and is treating the situation with the highest priority. Details about the flaw itself have not been disclosed, but the vulnerability was reproduced by PaperCut’s security team after a university customer reported suspicious behavior on their server.

PaperCut print management software is used in schools, universities, hospitals, law firms, and large enterprises around the world to manage and track printing across networks. PaperCut’s own advisory says the flaw affects all versions of PaperCut NG and MF. The company is urging any organization with an internet-exposed PaperCut Application Server to immediately apply the emergency patch, or if patching is not immediately possible, to use firewall rules or network access controls to restrict the server’s web interface to trusted IP addresses only. PaperCut has a history of being targeted: a critical 2023 vulnerability (CVE-2023-27350) was exploited by Clop, LockBit, and Iranian state-backed hacking groups, and a 2023 joint FBI and CISA advisory warned of attacks against the education sector.

How to check if you’re affected

Affected versions include all currently released versions of PaperCut NG and PaperCut MF with an Application Server exposed to the internet. PaperCut has shared indicators of compromise that administrators should check immediately:

• Look for suspicious activity originating from the legitimate pc-app.exe process.
• Check whether server.log files have been modified, deleted, or are missing entirely.
• Search server.log for these error messages, which indicate active exploitation attempts:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Note that the absence of these indicators does not guarantee a server has not been compromised. Apply the emergency patch and restrict network access regardless.

Sources

• PaperCut warns of NG, MF flaw exploited in zero-day attacks — BleepingComputer