FROM PATCH TO EXPLOIT; USING CLAUDE CODE TO REVERSE ENGINEER A ZERO-DAY IN PAPERCUT NG

Summary from the TLDR InfoSec newsletter

Kev Breen used Claude Code against a patched PaperCut NG zero-day, spotting SQL injection IoCs in error logs and finding the patch blocked CALL/EXEC/SYSCS_ calls in the SQL lookup template. Claude decompiled the JARs, found an auth-bypass filter flaw using a matrix parameter, then a second bypass in pageValidate letting an unauth service parameter reach admin pages. Chaining both gave unauthenticated RCE via arbitrary file write as the papercut user, confirmed with a working Python PoC. A guardrail swapped the model mid-session when it probed exploitation logs. Breen later found a third bypass defeating the emergency patch and reported it to security@papercut.com, who said they were already aware.