Command Injection / RCE｜Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch B

Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs.Paper! It still exists.We have

一、核心思路

• 【方法模板·非来源原文】入口发现：从 JS/路由/流量/历史路径交叉确认该漏洞类别的输入面，单一样本不下结论
• 来源链接: https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
• 分类命中词: {'Command Injection / RCE': ['os command', 'rce'], 'Authentication Bypass': ['authentication bypass'], 'Cloud Security / IAM / Storage': ['oss']}

二、成立条件

• 【来源原文片段】d unclear.How many vulnerabilities were exploited in this chain?Did any of them require authentication?Were the attackers exploiting post-authentication vulnerabilities?Whi
• 【来源原文片段】core features include print quotas, secure release printing (a job is released only after the user logs in at the printer), cost tracking, and detailed reporting. Togethe
• 【来源原文片段】ch becomes the root page.Then define another page and its form to invoke, which requires authentication.The result? An unauthenticated attacker can reach the forms of authen

三、验证方法与步骤

• 【方法模板·非来源原文】入口发现：从 JS/路由/流量/历史路径交叉确认该漏洞类别的输入面，单一样本不下结论
• 【方法模板·非来源原文】前置条件：记录认证状态、角色、数据所有权、组件与版本
• 【方法模板·非来源原文】测试变量：参数位置、对象标识、方法、请求头、数据格式、状态切换
• 【方法模板·非来源原文】成功证据：真实数据读取/命令执行回显/状态真实变更（可复现，带原始报文）
• 【方法模板·非来源原文】误报过滤：登录跳转、统一错误页、WAF 阻断页、缓存内容、通用 200、非确定性字段
• 【方法模板·非来源原文】影响确认：只读证明优先；写操作仅在自建 canary 对象上做一次最小验证

【缺失】来源未给出可执行复现步骤；需按 test_methodology 在授权靶场自行设计并记录

四、误报排除

• 登录页/统一错误页/WAF 阻断页/缓存页/通用 200 空壳
• 非确定性字段（traceId/timestamp/随机 token）必须先归一化

五、影响与修复

影响：

分类：Command Injection / RCE；来源严重性：未提供。实际影响需以本地/授权靶场复现结果为准，评分与来源自述不构成影响结论。

修复：

按该类漏洞的通用根因修复（服务端校验/白名单/最小权限），并补充回归测试。

关联：CVE-2023-27350、CVE-2023-27351、CVE-2026-81578、CVE-2026-81579、CVE-2026-82077、CVE-2026-82078

六、原始来源

https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/

---

本文由 QGG 渗透大师自动学习整理：内容取自公开报告，未在未授权目标上做任何验证。