Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic authentication bypass in the web application's request handling logic. PaperCut uses the Apache Tapestry framework, and the exploit leverages a weakness in how 'complex-direct' requests are handled. The application correctly checks for authentication on the page being rendered to the user but fails to check authentication for the backend component being invoked. This allows an unauthenticated attacker to call administrative functions by routing their request through a public page. The exploit specifically targets the 'ConfigEditor' to modify the 'external user lookup' settings to point to a malicious JDBC URL. Then, by triggering a user search via the 'UserList' page, the application attempts to connect to the malicious database, leading to remote code execution. The vulnerable functions are therefore the administrative components that can be accessed without authentication and the database connection function that is subsequently abused.
com.papercut.app.pages.ConfigEditor.quickFindFormcom/papercut/app/pages/ConfigEditor.java
com.papercut.app.pages.ConfigEditor.$Formcom/papercut/app/pages/ConfigEditor.java
com.papercut.app.pages.UserList.$QuickFind.$Formcom/papercut/app/pages/UserList.java
com.papercut.app.db.DatabaseUtils.getConnectioncom/papercut/app/db/DatabaseUtils.java