Name:PaperCut NG Remote Web Access Attempt id:9fcb214a-dc42-4ce7-a650-f1d2cab16a6a version:10 date:None author:Michael Haag, Splunk status:production type:TTP Description:The following analytic detects potential exploitation attempts on publicly accessible PaperCut NG servers.
It identifies connections from public IP addresses to the server, specifically monitoring URI paths commonly used in proof-of-concept scripts for exploiting PaperCut NG vulnerabilities.
This detection leverages web traffic data from the `Web` datamodel, focusing on specific URI paths and excluding internal IP ranges.
This activity is significant as it may indicate an attempt to exploit known vulnerabilities in PaperCut NG, potentially leading to unauthorized access or control of the server.
If confirmed malicious, attackers could gain administrative access, leading to data breaches or further network compromise.
Data_source:
-Suricata
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
