PaperCut NG Remote Web Access Attempt

Try in Splunk Security Cloud

Description

The following analytic detects potential exploitation attempts on publicly accessible PaperCut NG servers. It identifies connections from public IP addresses to the server, specifically monitoring URI paths commonly used in proof-of-concept scripts for exploiting PaperCut NG vulnerabilities. This detection leverages web traffic data from the Web datamodel, focusing on specific URI paths and excluding internal IP ranges. This activity is significant as it may indicate an attempt to exploit known vulnerabilities in PaperCut NG, potentially leading to unauthorized access or control of the server. If confirmed malicious, attackers could gain administrative access, leading to data breaches or further network compromise.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Web
• Last Updated: 2024-05-23
• Author: Michael Haag, Splunk
• ID: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

T1133

External Remote Services

Persistence, Initial Access

Kill Chain Phase

• Delivery
• Installation

NIST

• DE.CM

CIS20

• CIS 13

CVE

Search

| tstats count from datamodel=Web where Web.url IN ("/app?service=page/SetupCompleted", "/app", "/app?service=page/PrinterList", "/app?service=direct/1/PrinterList/selectPrinter&sp=*", "/app?service=direct/1/PrinterDetails/printerOptionsTab.tab") NOT (src IN ("10.*.*.*","172.16.*.*", "192.168.*.*", "169.254.*.*", "127.*.*.*", "fc00::*", "fd00::*", "fe80::*")) by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.dest_port sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `papercut_ng_remote_web_access_attempt_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime

papercut_ng_remote_web_access_attempt_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• Web.http_user_agent
• Web.http_method
• Web.url
• Web.url_length
• Web.src
• Web.dest
• sourcetype

How To Implement

To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the Web datamodel.

Known False Positives

False positives may be present, filter as needed.

Associated Analytic Story

• PaperCut MF NG Vulnerability

RBA

Risk Score	Impact	Confidence	Message
63.0	90	70	URIs specific to PaperCut NG have been access by a public IP against $dest$.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
• https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
• https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
• https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
• https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2