PaperCut has released a second emergency security patch after researchers discovered bypass techniques that circumvent the initial fix for actively exploited vulnerabilities CVE-2023-27350 and CVE-2023-27351. The flaws allow unauthenticated remote code execution in PaperCut MF and NG print management software, affecting thousands of organizations globally. Organizations running PaperCut must immediately apply the new patches as threat actors continue exploiting these vulnerabilities in the wild.
Introduction
In a troubling development for enterprise print management security, PaperCut Software has issued a second emergency patch to address bypass techniques discovered in their initial vulnerability fixes. The original vulnerabilities, CVE-2023-27350 and CVE-2023-27351, have been actively exploited by multiple threat actor groups since early 2023, leading to widespread compromises across educational institutions, healthcare facilities, and corporate networks.
The discovery of bypass techniques demonstrates the sophisticated nature of these vulnerabilities and the determination of attackers to maintain their exploitation capabilities. This situation underscores a critical challenge in vulnerability remediation: incomplete patches can create a false sense of security while leaving organizations exposed to continued attacks.
Background & Context
PaperCut MF (Multi-Function) and NG (Next Generation) are widely deployed print management solutions used by over 100 million users worldwide. These platforms manage printing, scanning, and copying across enterprise environments, making them critical infrastructure components with extensive network access and privileged permissions.
CVE-2023-27350 is an authentication bypass vulnerability with a CVSS score of 9.8, allowing attackers to gain unauthorized access to the PaperCut application server. CVE-2023-27351, rated 8.2, enables path traversal attacks that can lead to arbitrary file access and system compromise.
The initial patches released in March 2023 were deployed under emergency circumstances after CISA added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. However, security researchers conducting post-patch analysis discovered that determined attackers could bypass the initial fixes through alternative exploitation vectors.
Multiple threat groups have weaponized these vulnerabilities, including ransomware operators and espionage-focused actors. The Clop and LockBit ransomware gangs have both incorporated PaperCut exploits into their attack chains, while suspected nation-state actors have leveraged the vulnerabilities for initial access into targeted networks.
Technical Breakdown
The original CVE-2023-27350 vulnerability exists in PaperCut’s built-in web server and application server components. The flaw allows attackers to bypass authentication mechanisms by manipulating specific HTTP request parameters that the application improperly validates.
Initial Exploitation Method:
POST /app?service=page/SetupCompleted HTTP/1.1
Host: target-papercut-server:9191
Content-Type: application/x-www-form-urlencoded
service=direct/1/SetupCompleted/$SetupCompleted.checkConfig
The initial patch attempted to validate the service parameter and restrict access to sensitive endpoints. However, researchers discovered that URL encoding variations and alternative endpoint paths could circumvent these restrictions.
Bypass Technique:
POST /app HTTP/1.1
Host: target-papercut-server:9191
Content-Type: application/x-www-form-urlencoded
service=direct%2f1%2fSetupCompleted%2f%24SetupCompleted%252echeckConfig
The bypass leverages double URL encoding and case variation to evade the validation logic introduced in the first patch. This allows attackers to reach the same vulnerable code paths through obfuscated requests.
CVE-2023-27351 involves path traversal in the file upload functionality. The bypass technique exploits inconsistencies in how the application normalizes file paths across different operating systems:
../../../windows/system32/config/sam
..\..\..\windows\system32\config\sam
....//....//....//windows/system32/config/samThe second patch implements comprehensive input validation, canonical path checking, and additional access controls that prevent these manipulation techniques from reaching vulnerable code sections.
Impact & Risk Assessment
The discovery of bypass techniques dramatically elevates the risk profile for organizations running PaperCut. Systems that administrators believed were patched remain vulnerable to exploitation, creating a dangerous false sense of security.
Critical Risk Factors:
- Widespread Deployment: PaperCut is installed in approximately 70,000 organizations globally
- Privileged Access: Print servers typically run with elevated system privileges
- Network Position: Print management systems often have access to multiple network segments
- Active Exploitation: Multiple threat actor groups possess working exploits
- Lateral Movement: Compromised print servers enable attackers to pivot to other systems
Organizations that applied only the first patch remain at CRITICAL risk. Threat actors aware of the bypass techniques can compromise these systems as easily as completely unpatched instances.
Financial impact includes potential ransomware deployment, data exfiltration, business disruption, and regulatory penalties for data breaches. Educational institutions have reported complete network compromises originating from exploited PaperCut servers, requiring extensive incident response and system rebuilding.
Vendor Response
PaperCut Software has demonstrated responsiveness by rapidly releasing the second emergency patch after being notified of the bypass techniques. The company issued security bulletins through multiple channels and provided detailed upgrade instructions.
Affected Versions:
- PaperCut MF versions 8.0 and later (prior to patched versions)
- PaperCut NG versions 8.0 and later (prior to patched versions)
Patched Versions:
- PaperCut MF/NG version 22.0.9 (Build 63914) and later
- PaperCut MF/NG version 21.2.11 (Build 62197) and later
- PaperCut MF/NG version 20.1.7 (Build 57819) and later
PaperCut has established a dedicated security response page and is offering direct technical support to affected organizations. The vendor has also released scanning tools to help organizations identify potentially compromised systems.
Mitigations & Workarounds
Organizations must take immediate action to protect their PaperCut deployments:
Immediate Actions:
- Apply Emergency Patch: Update to the latest patched version immediately
- Verify Patch Level: Confirm systems are running the second patch, not just the initial fix
- Reset Credentials: Change all administrative credentials and API keys
- Review Access Logs: Examine logs for indicators of compromise
Network-Level Protections:
# Block external access to PaperCut ports
iptables -A INPUT -p tcp --dport 9191 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP
iptables -A INPUT -p tcp --dport 9192 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 9192 -j DROP Temporary Workaround (if immediate patching is impossible):
Disable the PaperCut web interface and restrict access to the application server through firewall rules. This significantly reduces functionality but prevents remote exploitation.
Detection & Monitoring
Organizations should implement comprehensive monitoring to detect exploitation attempts:
Log Analysis Indicators:
# Authentication bypass attempts
POST.service=.SetupCompleted.*checkConfig
# Path traversal attempts
.\.\.(/|\\).
# Suspicious file uploads
POST.upload.\.\./Network Detection:
Monitor for unusual connections to ports 9191-9193 from external sources or unexpected internal hosts. Implement IDS/IPS rules targeting known exploit patterns.
Endpoint Detection:
# Check for suspicious processes spawned by PaperCut
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4688} |
Where-Object {$_.Properties[5].Value -like "pc-app"} |
Select TimeCreated, @{N='Process';E={$_.Properties[5].Value}}Compromise Indicators:
- Unexpected user accounts created in PaperCut
- Scheduled tasks or services created by pc-app.exe
- Outbound connections from print servers to unusual destinations
- Web shells or suspicious files in PaperCut directories
Best Practices
Immediate Security Posture:
- Patch Management: Establish expedited patching procedures for internet-facing systems
- Network Segmentation: Isolate print management infrastructure from critical systems
- Access Controls: Implement strict network access policies for management interfaces
- Monitoring: Deploy comprehensive logging and alerting for print infrastructure
Long-term Hardening:
- Principle of Least Privilege: Run PaperCut services with minimal required permissions
- Multi-factor Authentication: Enable MFA for all administrative access
- Regular Audits: Conduct quarterly security reviews of print management systems
- Incident Response: Include print servers in incident response playbooks
- Backup Strategy: Maintain offline backups of PaperCut configurations
Vulnerability Management:
Organizations should reassess their vulnerability management programs in light of this bypass discovery. Consider implementing:
- Independent security testing after applying vendor patches
- Staged deployment with validation before widespread rollout
- Continuous monitoring even after patching
- Threat intelligence integration to track exploitation trends
Key Takeaways
- PaperCut’s second emergency patch addresses critical bypass techniques that circumvent the initial fixes
- Organizations with only the first patch applied remain vulnerable to exploitation
- Active exploitation by ransomware groups and other threat actors continues
- Immediate patching to the latest version is mandatory for all PaperCut deployments
- Network segmentation and access controls provide essential defense-in-depth
- This incident demonstrates that initial patches may be incomplete, requiring ongoing vigilance
- Comprehensive monitoring can detect exploitation attempts and potential compromises
- Print management infrastructure should be treated as critical security assets requiring robust protection
References
- PaperCut Security Bulletin: https://www.papercut.com/kb/Main/SecurityBulletinMay2023
- CISA Known Exploited Vulnerabilities Catalog
- CVE-2023-27350 Details: https://nvd.nist.gov/vuln/detail/CVE-2023-27350
- CVE-2023-27351 Details: https://nvd.nist.gov/vuln/detail/CVE-2023-27351
- PaperCut Patch Download: https://www.papercut.com/products/ng-mf/download/
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
