CVE-2023-39143

CRITICALNuclei

PaperCut papercut_mf Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-39143 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 17, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

papercut_mf

Browse PaperCut / papercut_mf
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubforegenix/CVE-2023-39143Repository PoCby foregenix0Exploit8 files

74.5 KiB

GitHub
PoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2023-39143 in PaperCut NG/MF. It uses path traversal in WebDAV to read arbitrary files (e.g., server.properties, server.uuid), enumerates users, and uploads a modified server.properties to change the admin password, leading to remote code execution.

Backdoor review

Suspicious behavior

The PoC script for CVE-2023-39143 contains hardcoded, non-placeholder credentials for the PaperCut XML-RPC interface that are used automatically without operator configuration. The script's primary documented purpose is to exploit a path traversal vulnerability, but it also silently authenticates to the target's XML-RPC service using a fixed username and password, which is a material contradiction to the operator's expectation of configuring their own credentials.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwarePaperCut NGPaperCut MF
Attack typespath traversalremote code executionauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2023-39143 by performing path traversal to read and write arbitrary files, ultimately modifying the admin password to achieve remote code execution. It includes functions for file exfiltration (copy_file), file upload (upload_webdav_file), and password replacement (replace_admin_password).

CVE-2023-39143.py:262-296CVE-2023-39143.py:320-334CVE-2023-39143.py:336-371

Requirements

  • Target PaperCut server with external device integration enabled and WebDAV accessible.CVE-2023-39143.py:488-490
  • Valid WebDAV password for the 'papercut-webdav' user.CVE-2023-39143.py:490
  • Valid XML-RPC credentials for device registration and scan job creation.CVE-2023-39143.py:660

Observed behavior

  • Reads arbitrary files from the server using path traversal in WebDAV COPY requests.CVE-2023-39143.py:262-296
  • Enumerates user directories via WebDAV PROPFIND with path traversal.CVE-2023-39143.py:609-616
  • Modifies the admin password in server.properties and uploads the modified file via WebDAV PUT with path traversal.CVE-2023-39143.py:320-334CVE-2023-39143.py:336-371
  • Creates scan jobs via XML-RPC to obtain a scanJobId used in the upload path.CVE-2023-39143.py:702-717
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Automatic Authentication
  • The script automatically authenticates to the target's XML-RPC interface using a hardcoded, non-placeholder credential pair ('papercut-dev' / '155d750995d18f6d4e870e25cb409f67') without any operator input or configuration. This behavior is not disclosed in the script's help text or argument definitions, which only request a WebDAV password.CVE-2023-39143.py:660

Observables

Hardcoded Credential
Payload withheldThis credential is used automatically in the XML-RPC session initiation without the operator's knowledge or consent. The script's argument parser only asks for a WebDAV password, not XML-RPC credentials.CVE-2023-39143.py:660
Review boundaries

What the analysis did not establish

  • Only one of eight repository files was provided as text; the remaining seven files (including README.md) were omitted due to size budget.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files were inspected.
  • Only the main Python script was provided for review; 7 other files in the repository were omitted from the text evidence.
  • The validity, ownership, and reachability of the hardcoded credential cannot be confirmed from the provided evidence alone.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALPaperCut < 22.1.3 - Path TraversalCVSS 9.8

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.

Impact

An attacker can exploit this vulnerability to access sensitive files, potentially leading to unauthorized disclosure of information or remote code execution.

Remediation

Upgrade PaperCut to version 22.1.3 or later to mitigate the vulnerability.

WeaknessesCWE-22
Authorspdteam
Template tagscve2023cvelfipapercutvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
Shodan: html:"content=\"PaperCut\""
Shodan: http.html:"papercut"
Shodan: http.html:"content=\"papercut\""
Shodan: cpe:"cpe:2.3:a:papercut:papercut_mf"
FOFA: body="papercut"
FOFA: body="content=\"papercut\""
https://nvd.nist.gov/vuln/detail/CVE-2023-39143 https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/ https://www.papercut.com/kb/Main/securitybulletinjuly2023/ https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

3