PaperCut NG Remote Web Access Attempt

Try in Splunk Security Cloud

Description

The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCut NG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCut NG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCut NG servers. When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCut NG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Web
• Last Updated: 2023-05-15
• Author: Michael Haag, Splunk
• ID: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Kill Chain Phase

• Delivery

NIST

• DE.CM

CIS20

• CIS 13

CVE

Search

| tstats count from datamodel=Web where Web.url IN ("/app?service=page/SetupCompleted", "/app", "/app?service=page/PrinterList", "/app?service=direct/1/PrinterList/selectPrinter&sp=*", "/app?service=direct/1/PrinterDetails/printerOptionsTab.tab") NOT (src IN ("10.*.*.*","172.16.*.*", "192.168.*.*", "169.254.*.*", "127.*.*.*", "fc00::*", "fd00::*", "fe80::*")) by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.dest_port sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `papercut_ng_remote_web_access_attempt_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime

papercut_ng_remote_web_access_attempt_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• Web.http_user_agent
• Web.http_method
• Web.url
• Web.url_length
• Web.src
• Web.dest
• sourcetype

How To Implement

To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the Web datamodel.

Known False Positives

False positives may be present, filter as needed.

Associated Analytic Story

• PaperCut MF NG Vulnerability

RBA

Risk Score	Impact	Confidence	Message
63.0	90	70	URIs specific to PaperCut NG have been access by a public IP against $dest$.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
• https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
• https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
• https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
• https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1