title: CVE-2026-82078 PaperCut JVM spawns interactive shell (process lineage kill-shot)
id: 7c1f2a34-8b6e-4a51-9d0c-3f5a2e1b7c03
status: test
description: >
  EXECUTION rule (process creation). Detects the exact lineage our authorized
  reproduction produced on PaperCut NG 25.0.11.75758 (captured by the payload
  itself + harness polls, evidence/run-04c-rshell-*/reverse-shell-session.txt
  and processes/...-tree.txt):

    papercut  8694  app-monitor (Tanuki wrapper)
      -> papercut  8696  ../runtime/linux-x64/jre/bin/pc-app ... org.tanukisoftware.wrapper.WrapperSimpleApp biz.papercut.pcng.server.AppServer
           -> papercut  11666  /bin/sh -i              (payload: Socket->/bin/sh -i)
                -> papercut  11676  ps -ef             (grandchild recon cmd)

  The PaperCut application JVM (comm 'pc-app'; cmdline always carries
  org.tanukisoftware.wrapper + a papercut token) NEVER legitimately execs an
  interactive shell - measured pre/post process snapshots across 8 lab runs
  show zero shell children of the JVM in any clean window. This is the
  strongest host-side statement in the package: unlike every wire attempt
  rule, it cannot fire on a patched arm because the payload is never loaded;
  it requires the injected class to have RUN. The '-i' (interactive) shape
  matches the msf-family connect-back and Java
  ProcessBuilder("/bin/sh","-i") payloads generically. The ps -ef grandchild
  is detected by the companion catch-all rule (attacker recon commands vary;
  ANDing them here would blind the kill-shot itself).
author: Xpectra Security Research
date: 2026-09-11
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82078
  - https://github.com/rapid7/metasploit-framework
logsource:
  category: process_creation
  product: linux
detection:
  # Axis 1 (AND) - parent is the PaperCut application JVM. Field aliases:
  # Sysmon-style ParentImage/ParentCommandLine + ECS equivalents.
  pimg_pcapp_sysmon:
    ParentImage|endswith: '/pc-app'
  pimg_pcapp_ecs:
    parent_process.executable|endswith: '/pc-app'
  pcmd_wrapper_sysmon:
    ParentCommandLine|contains|all:
      - 'org.tanukisoftware.wrapper'
      - 'papercut'
  pcmd_wrapper_ecs:
    parent_process.command_line|contains|all:
      - 'org.tanukisoftware.wrapper'
      - 'papercut'
  # Axis 2 (AND) - child is an interactive shell
  cimg_sh_sysmon:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  cimg_sh_ecs:
    process.executable|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  cargv_i_sysmon:
    CommandLine|contains|all:
      - 'sh'
      - '-i'
  cargv_i_ecs:
    process.command_line|contains|all:
      - 'sh'
      - '-i'
  # Tuning filter: none shipped - a -i shell under the app JVM has no
  # legitimate identity on this product (see falsepositives).
  condition: >
    (1 of pimg_pcapp_* or 1 of pcmd_wrapper_*)
    and (1 of cimg_sh_*) and (1 of cargv_i_*)
falsepositives:
  - "A PaperCut 'custom-program' user-lookup integration that execs an interactive shell under the app JVM - vendor docs run custom programs as non-interactive scripts; if your estate does this, filter the script path."
  - "Container debug sessions (docker/kubectl exec) parent under entrypoint/init, NOT pc-app, so axis 1 excludes them (verified: clean-window process snapshots contain sh children of bash /usr/local/bin/entrypoint.sh only)."
level: critical
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026-82078