CVE-2023-27350
📋 TL;DR
CVE-2023-27350 is an authentication bypass vulnerability in PaperCut NG/MF that allows unauthenticated remote attackers to gain SYSTEM-level access and execute arbitrary code. This affects PaperCut NG/MF installations with the vulnerable SetupCompleted class. Organizations running affected PaperCut versions are at immediate risk of complete system compromise.
💻 Affected Systems
- PaperCut NG
- PaperCut MF
📦 What is this software?
Papercut Mf by Papercut
Papercut Mf by Papercut
Papercut Mf by Papercut
Papercut Ng by Papercut
Papercut Ng by Papercut
Papercut Ng by Papercut
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with SYSTEM privileges, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthenticated attackers gain administrative access to PaperCut, install malware, steal credentials, and pivot to other systems.
If Mitigated
Limited impact if network segmentation, strict firewall rules, and endpoint protection prevent exploitation attempts.
🎯 Exploit Status
Multiple public exploit scripts and proof-of-concepts exist. Actively exploited in the wild since April 2023 with ransomware groups leveraging it.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PaperCut NG/MF version 22.0.6 or later
Vendor Advisory: https://www.papercut.com/kb/Main/Security-Bulletin-May-2023/
Restart Required: Yes
Instructions:
1. Download latest version from PaperCut website. 2. Backup configuration and database. 3. Stop PaperCut services. 4. Install update. 5. Restart services. 6. Verify functionality.
🔧 Temporary Workarounds
Network Isolation
allBlock external access to PaperCut web interface (default ports 9191, 9192)
# Firewall rule to block port 9191/tcp and 9192/tcp from external networks
Access Restriction
allRestrict PaperCut web interface to trusted IP addresses only
# Configure web server (Apache/Nginx/IIS) to allow only specific IP ranges
🧯 If You Can't Patch
- Immediately isolate PaperCut servers from internet and restrict network access to management VLAN only
- Implement strict network monitoring and IDS/IPS rules to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check PaperCut version in Admin interface > About, or run: java -jar papercut-print-log-archiver.jar --versionCheck Version:
On server: cat /usr/local/papercut/server/bin/win64/application-server/version.txt (Linux) or check Windows service propertiesVerify Fix Applied:
Confirm version is 22.0.6 or higher and attempt to access /setup/setupCompleted?completed=1 endpoint returns proper authentication requirement📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /setup/setupCompleted endpoint
- Unexpected administrative actions from unknown IPs
- New user creation or privilege escalation
Network Indicators:
- HTTP requests to /setup/setupCompleted?completed=1 without authentication
- Unusual outbound connections from PaperCut server
SIEM Query:
source="papercut" AND (uri="/setup/setupCompleted" OR status=200 AND method=GET AND uri CONTAINS "setupCompleted")🔗 References
- http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html
- https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- https://www.zerodayinitiative.com/advisories/ZDI-23-233/
- http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html
- https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- https://www.zerodayinitiative.com/advisories/ZDI-23-233/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27350
