PaperCut-CVE-2026-81578-82078

Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078

Key references:

• Rapid7 – PaperCut NG/MF Critical Zero‑Day Exploited in the Wild
• IONIX – CVE-2026-81578 Deep Dive
• VulDB – CVE-2026-81578 / CVE-2026-82078
• PaperCut Security Bulletin – August 27, 2026

⚠️ Important: Accuracy & Responsible Disclosure

This tool performs indicator‑based remote detection. It does not claim to prove exploitability on real PaperCut servers unless --force is used with explicit written authorization.

Confidence scores are calculated based on the weight of evidence and are capped at 85% for remote detection to avoid over‑claiming.

🚀 Features

• ✅ Fingerprinting – detect PaperCut version, Apache Tapestry framework, and exposed endpoints
• ✅ Indicator‑based CVE Assessment – safe, non‑destructive checks with honest status reporting
• ✅ Educational Local Lab – reproduces vulnerability concepts in a controlled environment
• ✅ Remote Exploitation – with --force flag (authorization required)
• ✅ Batch Scanning – process multiple targets with multi‑threading (--input, --threads)
• ✅ Port Prefilter – quickly check open ports before deep scanning (--prefilter)
• ✅ Log Detection – IOC‑based analysis for suspicious activity patterns
• ✅ Professional Reporting – HTML, JSON, and text formats with detailed evidence
• ✅ Interactive Mode – menu‑driven interface for ease of use
• ✅ Self‑Test – verifies tool functionality and dependencies

🛡️ Security Boundaries

📦 Installation

🔧 Quick Start

📖 CLI Commands

Global Options

Batch & Prefilter Options

🧪 Educational Local Lab

The lab is a minimal Python HTTP server that reproduces the concepts of both vulnerabilities for educational purposes.

CVE-2026-81578 – Tapestry "Complex Direct" Bypass

• Invokes an administrative component (ConfigEditor, UserList) while displaying a public page (Error.page, Exception.page)
• Demonstrates how authentication checks apply only to the displayed page, not the invoked component

CVE-2026-82078 – Unsafe Class Loading

• Instantiates a JDBC driver class from a user‑supplied name without allowlist validation
• Shows how arbitrary class names could be loaded, potentially leading to RCE

Lab endpoints:

• http://127.0.0.1:8080/lab/cve-81578?component=ConfigEditor&display=Error
• http://127.0.0.1:8080/lab/cve-82078?driver=org.attacker.RCEPayload

📊 Log Detection

The tool analyses log files for suspicious indicators (IOCs) derived from the vulnerability mechanics:

📝 Report Generation

Generate professional reports in HTML, JSON, or plain text.

HTML report includes:

• Executive summary with target and fingerprint details
• CVE findings with status, confidence, indicators, and evidence
• Technical details and remediation recommendations
• Methodology and limitations disclaimer

📁 Affected Versions

Based on PaperCut Security Bulletin (August 27, 2026):

🔬 Technical Details

CVE-2026-81578 – Authentication Bypass

PaperCut uses the Apache Tapestry framework. Tapestry's "complex direct" request format allows specifying both:

• A page to display (e.g., Error.page)
• A different page containing the component to execute (e.g., ConfigEditor.page)

Access validation only checks the displayed page, not the component being executed. Attackers can invoke administrative components while displaying public pages, bypassing authentication entirely.

Attack vector: POST /papercut/ConfigEditor.page?... with .zone request, displayed via Error.page

CVE-2026-82078 – Unsafe Dynamic Class Loading

PaperCut instantiates JDBC database driver classes from configurable driver names (e.g., database.driver.class). The application does not validate these class names against an allowlist. Attackers who can manipulate system configuration (via the authentication bypass or other means) can specify arbitrary Java class names, which are loaded and instantiated by the PaperCut service process.

Impact: Remote Code Execution (RCE) under the security context of the PaperCut service.

🧠 Methodology

1. Fingerprinting – gather version, framework, and exposed endpoints via safe HTTP probes.
2. Version Assessment – compare detected version against vendor advisory fixed versions.
3. Indicator Collection – check for Tapestry framework, accessible admin endpoints, and database configuration endpoints.
4. Confidence Scoring – weighted combination of indicators (max 85% for remote detection).
5. Reporting – transparently present findings with evidence and recommendations.

⚠️ Limitations

• Remote detection is indicator‑based – it does not prove exploitability.
• False positives are possible – accessible endpoints may be intentional or protected by other mechanisms.
• Version detection may fail – some PaperCut installations hide version information.
• The local lab is a simulation – it reproduces concepts but does not execute real Java code or contain PaperCut proprietary logic.
• Log detection is pattern‑based – it may miss novel attack variants.

🤝 Contributing

Contributions are welcome! Please read CONTRIBUTING.md for guidelines.

📄 License

MIT License – see LICENSE for details.

⚖️ Responsible Use

This tool is for authorised security testing and educational purposes only. Do not use against any system without explicit written permission. The concept demonstrations are locked to localhost and will not work against remote hosts.

By using this tool, you agree to:

• Use it only on systems you own or have permission to test
• Not use it for malicious purposes
• Accept that the author provides no warranty and is not liable for any misuse

📚 References

1. PaperCut Security Bulletin – Urgent Security Advisory
2. Rapid7 – PaperCut NG/MF Critical Zero‑Day Exploited in the Wild
3. IONIX – CVE-2026-81578 Analysis
4. VulDB – CVE-2026-81578
5. VulDB – CVE-2026-82078
6. CISA – Known Exploited Vulnerabilities Catalog

Version: 3.1.0
Last Updated: 2026-08-29
Maintainer: yora 1928

“Security is not a product, but a process.” – Bruce Schneier