CVE-20 — What It Is,

Unpacking CVE-20

This analysis focuses on CVE-2023-27350, a critical authentication bypass vulnerability impacting PaperCut MF and NG print management software. Attackers can exploit this flaw to bypass authentication and achieve remote code execution (RCE) with SYSTEM privileges on affected servers. This vulnerability has been actively exploited in the wild by various threat actors, including ransomware groups.

What the Vulnerability Is and Its Impact

CVE-2023-27350 is an improper access control vulnerability within the SetupCompleted class of PaperCut MF and NG. This flaw allows unauthenticated remote attackers to bypass the login process and gain administrative access to the server. Once authenticated, attackers can leverage existing PaperCut features, such as the print scripting interface, to execute arbitrary code.

The vulnerability carries a CVSS v3.1 base score of 9.8, categorizing it as Critical. This high score reflects the severity of the issue: it requires no authentication (AV:N, PR:N, UI:N), has low attack complexity (AC:L), and results in complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H). Affected versions include PaperCut MF and NG from 8.0.0 up to 19.2.7, 20.0.0 up to 20.1.6, 21.0.0 up to 21.2.10, and 22.0.0 up to 22.0.8.

Technical Root Cause Analysis

The root cause of CVE-2023-27350 lies in improper access control within the SetupCompleted Java class. PaperCut systems use this class during the initial setup process. After installation, the application redirects users to a SetupCompleted page, which includes a "Login" button.

Decompiling the SetupCompleted.java file reveals that the code calls the performLogin method as an administrator without requiring any credentials. Specifically, the performLogin function permits loginType.Admin access without proper authentication checks. This allows an attacker to effectively log in as an administrator simply by accessing this specific endpoint.

The vulnerability is not a traditional deserialization flaw, but rather a direct consequence of inadequate authorization logic. By exploiting this flaw, an unauthenticated attacker can invoke privileged functions intended only for post-installation administrative access. This bypass grants the attacker the necessary permissions to proceed with further malicious actions on the server.

Exploitation Mechanics

Exploiting CVE-2023-27350 typically involves a multi-step process, beginning with the authentication bypass. An attacker sends an HTTP GET request to the vulnerable /app?service=page/SetupCompleted&guest=true endpoint on the PaperCut server. This request, when processed by the flawed SetupCompleted class, grants the attacker an authenticated session.

Once authenticated, the attacker can then chain this bypass with other PaperCut features to achieve remote code execution. A common method involves abusing the built-in scripting functionality for printers. The print scripting interface allows administrators to develop JavaScript hooks for customizing printing workflows. These scripts execute in the context of the PaperCut service, which typically runs with SYSTEM or root-level privileges on Windows and Linux deployments, respectively.

An attacker would send subsequent HTTP POST requests to update server settings, enabling the scripting feature and modifying a printer's script. For example, a request might enable the print.script.sandboxed and print-and-device.script.enabled configuration keys. Following this, the attacker can inject malicious JavaScript code into a printer script. When a print job is processed through this modified printer, the malicious script executes with high privileges, allowing for arbitrary command execution.

Another known method involves using the User/Group Sync interface to execute a living-off-the-land-style attack. This approach also leverages the initial authentication bypass. The execution of child processes, like cmd.exe or powershell.exe, spawned from the pc-app.exe process, occurs with the same SYSTEM or root privileges.

Detection: How to Check if You're Affected

Organizations must actively monitor their PaperCut environments for indicators of compromise (IOCs) related to CVE-2023-27350. Network traffic analysis is crucial; look for unexpected requests directed to the /SetupCompleted page on your PaperCut server. Tools like network intrusion detection systems (NIDS) can be configured with specific signatures to flag such activity.

Secably's free website vulnerability scanner can help identify publicly exposed PaperCut instances and potentially flag known attack signatures. Our technology stack detector can also help confirm if you are running PaperCut MF or NG. For broader attack surface visibility, Zondex can assist in identifying internet-exposed PaperCut servers that might be vulnerable.

System monitoring should focus on child processes spawned by the PaperCut server's main executable, pc-app.exe. Malicious exploitation often leads to pc-app.exe launching unexpected processes like cmd.exe or powershell.exe. Review PaperCut application logs for entries indicating an "admin" user login from an unfamiliar IP address, especially if no legitimate administrative action was expected. Look for log entries showing changes to configuration keys like print.script.sandboxed or print-and-device.script.enabled, or modifications to printer scripts by an admin user.

# Example log entry indicating potential admin login bypass
# This is a conceptual example; actual log formats vary.
2023-04-15 10:30:05,123 INFO  [LoginService] User 'admin' logged into the administration interface from IP: 192.0.2.10

# Example log entry indicating script modification
# This is a conceptual example; actual log formats vary.
2023-04-15 10:35:10,456 INFO  [PrintScriptManager] Admin user 'admin' modified the print script on printer 'LaserJet_Finance'.

CISA's advisory provides additional detection strategies, including Suricata signatures for DNS lookups of known malicious domains associated with PaperCut exploitation. These signatures can assist network defenders in identifying post-exploitation activity.

Remediation Steps

Immediate patching is the most effective remediation for CVE-2023-27350. PaperCut released security updates in March 2023. Update all affected PaperCut MF and NG Application Servers and Site Servers to the patched versions: 20.1.7, 21.2.11, or 22.0.9 and later.

If immediate patching is not feasible, implement network segmentation to restrict access to PaperCut servers. Block all inbound traffic from untrusted external IP addresses to the web management ports, typically port 9191 (HTTP) and 9192 (HTTPS). Use firewall rules or network access controls to ensure only trusted internal networks can reach these interfaces.

Regularly audit user permissions and roles within PaperCut NG/MF. Remove or restrict unnecessary administrative privileges. Implement strong password policies and multi-factor authentication for all administrative accounts. Assume compromise if you were unable to patch immediately and conduct a thorough incident response, hunting for malicious activity using the provided detection signatures.

Timeline of Disclosure

• March 8, 2023: PaperCut released new versions of its software, including patches for CVE-2023-27350 and CVE-2023-27351. The vulnerabilities were reported through Trend Micro's Zero Day Initiative (ZDI).
• April 14, 2023: PaperCut observed the earliest suspicious activity related to CVE-2023-27350 in the wild.
• April 18, 2023: A PaperCut customer reported suspicious activity, leading to further investigation and confirmation of exploitation.
• April 19, 2023: PaperCut became aware of in-the-wild exploitation and published additional details, including initial indicators of compromise.
• April 20, 2023: CVE-2023-27350 was published to the National Vulnerability Database (NVD).
• April 21, 2023: Huntress released research detailing the vulnerability, exploitation details, and additional indicators of compromise. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities (KEV) Catalog.
• Early May 2023: The Bl00dy Ransomware Gang exploited vulnerable PaperCut servers, particularly in the Education Facilities Subsector, leading to data exfiltration and system encryption. Microsoft also reported exploitation by Lace Tempest (linked to Cl0p ransomware).