PoC exploit for abused PaperCut flaw is now public (CVE-2023-27350)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG PaperCut MF and PaperCut NG print management software contain an improper access control flaw (CWE-284) in the SetupCompleted class that allows an unauthenticated attacker to bypass authentication and reach internal administrative functionality. The flaw is triggered by sending crafted, unauthenticated requests to the PaperCut application's web interface, without requiring valid user credentials. A successful attacker gains the ability to execute code in the context of the SYSTEM account on the PaperCut server, typically a Windows print server, giving full control of that host. Any organization running PaperCut MF or NG is potentially affected, and exposure is highest where the server's web interface is reachable from the internet or by untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-04-21 with known ransomware use, and EPSS rates exploitation probability at 100% within 30 days. Do: Apply the vendor's updates as instructed (this is the required action in CISA KEV) — upgrade PaperCut MF/NG to the patched releases listed in PaperCut's security advisory rather than relying on unpatched installs. Until patched, restrict network access to the PaperCut web/admin interface so it is reachable only from trusted hosts, and check the server for signs of compromise given known ransomware use. Prioritize internet-facing PaperCut servers, which public scans show are exposed in the thousands. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masstens of thousands of organizations (~70k+) and millions of users; thousands of internet-exposed PaperCut servers | |
| CVE-2023-27351 | Authentication Bypass in PaperCut NG/MF Print Management Software CVE-2023-27351 is an improper authentication flaw (CWE-287) in the SecurityRequestFilter class of PaperCut NG and MF print management software, where the authentication algorithm is improperly implemented. A remote, unauthenticated attacker can trigger it over the network with no user interaction or special privileges to bypass authentication on the affected server (CVSS 3.1: 7.5). Once authentication is bypassed, the attacker gains access to the PaperCut system; in observed campaigns this access was leveraged to deliver Cl0p and LockBit ransomware, as confirmed by Microsoft. Organizations running PaperCut NG (version 22.0.5, Build 63914, is cited in the advisory) or PaperCut MF are affected. The flaw was exploited as a zero-day, is CISA KEV-listed (added 2026-04-20) with known ransomware use, and EPSS places the 30-day exploitation probability at 78.1%. Do: Upgrade PaperCut NG/MF to the fixed release per the vendor's emergency patch advisory, first confirming the running build (NG 22.0.5, Build 63914, is cited as affected). Restrict internet-facing access to PaperCut servers and hunt for signs of post-exploitation, given confirmed use to deliver Cl0p and LockBit ransomware. US federal agencies must apply mitigations per CISA BOD 22-01 (or vendor instructions) or discontinue use of the product if mitigations are unavailable. | 7.5 | 78% | KEV ransomware |
| large≈75,000+ sites/organizations (PaperCut NG/MF is deployed at tens of thousands of organizations; public scans have found thousands of servers directly… |
Full article638 words · extracted from helpnetsecurity.com · click to collapse
An unauthenticated RCE flaw (CVE-2023-27350) in widely-used PaperCut MF and NG print management software is being exploited by attackers to take over vulnerable application servers, and now there’s a public PoC exploit.
About the vulnerability
According to PaperCut, the attacks seem to have started on April 14, 2023 – a month and a week after the software maker released new PaperCut MF and NG versions that fixed CVE-2023-27350 and CVE-2023–27351, an unauthenticated information disclosure flaw that could allow attackers to access sensitive user information (usernames, email addresses, office/department information, and card numbers) without authentication.
On that same day, Trend Micro’s Zero Day Initiative (ZDI) – the vulnerability bug bounty program through which the two flaws were reported – published advisories for CVE-2023-27350 and CVE-2023-27351.
Both PaperCut and ZDI refrained from publishing in-depth technical details about the vulnerabilities. They just noted that:
- CVE-2023-27350 exists within the SetupCompleted class, stems from improper access control, and can result in an authentication bypass and remote code execution on vulnerable installations
- CVE-2023-27351 exists within the SecurityRequestFilter class, stems from an improper implementation of the authentication algorithm, and can result in an authentication bypass and disclosure of sensitive information
PaperCut says CVE-2023-27350 is being exploited but that they currently have no evidence that CVE-2023-27351 is.
CVE-2023-27350 affects PaperCut MF or NG version 8.0 or later (on all OS platforms); CVE-2023–27351 affects PaperCut MF or NG version 15.0 or later (on all OS platforms).
Users are advised to upgrade all Application Servers and Site Servers to PaperCut MF and NG versions 20.1.7, 21.2.11 or 22.0.9, which include a fix for both vulnerabilities. If updating is impossible, they should lock down network access to the servers by blocking all inbound traffic from external IPs to the web management port (port 9191 and 9192 by default).
“The security response team at PaperCut has been working with external security advisors to compile a list of unpatched PaperCut MF/NG servers that have ports open on the public internet. In addition to our email and in-app announcements to all customers, we’ve been using this list to proactively reach out to potentially exposed customers via multiple means,” the company said.
“If you suspect that your server has been compromised, we recommend taking server backups, then wiping the Application Server, and rebuilding the Application Server and restoring the database from a ‘safe’ backup point prior to when you discovered any suspicious behavior.”
A PoC for CVE-2023-27350 is available
Huntress researchers have shared on Friday that there are some 1,800 publicly exposed PaperCut servers that can be reached via port 9191, and that vulnerable servers are being exploited and have Atera and/or Syncro remote management and maintenance software installed on them, allowing attackers to achieve persistent remote access and code execution capabilities.
Another file that gets downloaded is a variant of the Truebot malware.
“Truebot is linked to an entity known as Silence, which in turn has historical links with the ransomware-related entity TA505 (or Clop). In the previous Truebot investigation, TA505 later claimed responsibility for using exploitation of GoAnywhere software as a precursor to ransomware,” the researchers noted.
“While the ultimate goal of the current activity leveraging PaperCut’s software is unknown, these links (albeit somewhat circumstantial) to a known ransomware entity are concerning. Potentially, the access gained through PaperCut exploitation could be used as a foothold leading to follow-on movement within the victim network, and ultimately ransomware deployment.”
They have shared indicators of compromise admins can use to determine if attackers have breached their servers and installed malware on them, as well as risk mitigation advice.
On Monday, Horizon3.ai published a post detailling their analysis of the advisory and patch, as well as how they built a proof-of-concept exploit (PoC) for CVE-2023-27350. We can expect other attackers to make use of the published information and PoC to mount successful attacks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/04/25/cve-2023-27350-poc/