CVE-2024-1882: 
PaperCut NG vulnerability analysis and mitigation

A vulnerability in PaperCut NG/MF application server (CVE-2024-1882) was discovered that allows authenticated admin users to create malicious payloads for remote code execution. The vulnerability was disclosed on March 14, 2024, affecting multiple versions of PaperCut NG and MF software (NVD).

The vulnerability exists within the EmailRenderer class and stems from improper validation of user-supplied strings before processing them with the template engine. It has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-76 (Improper Neutralization of Equivalent Special Elements) (ZDI, NVD).

If exploited, this vulnerability allows attackers to execute arbitrary code in the context of SYSTEM on the server hosting the PaperCut NG/MF application. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (ZDI).

The vulnerability requires authentication as an admin user to exploit. However, according to security researchers, the existing authentication mechanism can potentially be bypassed (ZDI).

PaperCut has released security updates to address this vulnerability. Affected versions include PaperCut NG/MF versions up to (excluding) 20.1.10, versions from 21.0.0 up to (excluding) 21.2.14, versions from 22.0.0 up to (excluding) 22.1.5, and versions from 23.0.1 up to (excluding) 23.0.7. Users are advised to upgrade to the latest patched versions (NVD).