Two critical vulnerabilities in PaperCut NG/MF print management software can be chained together to achieve unauthenticated remote code execution. The vulnerabilities affect versions prior to 20.1.7, 21.2.11, and 22.0.9, allowing attackers to bypass authentication mechanisms and execute arbitrary code on vulnerable servers. Organizations using PaperCut should immediately update to patched versions as exploitation requires no user interaction and can be performed remotely.
Introduction
PaperCut, a widely deployed print management solution used by educational institutions, healthcare facilities, and enterprises worldwide, has disclosed two critical vulnerabilities that, when combined, create a devastating attack chain. The flaws enable threat actors to execute arbitrary code on vulnerable servers without requiring any authentication credentials. With PaperCut installations managing print infrastructure for millions of users globally, the attack surface is substantial. This vulnerability disclosure underscores the persistent challenges in securing complex enterprise software, particularly when multiple weaknesses can be weaponized in sequence to bypass layered security controls.
Background & Context
PaperCut NG and PaperCut MF are comprehensive print management solutions that provide tracking, control, and auditing capabilities for printing activities across organizations. These platforms integrate deeply with network infrastructure, often running with elevated privileges to manage print queues, user authentication, and billing functions.
The two vulnerabilities in question involve an authentication bypass and a path traversal weakness that, when exploited sequentially, provide attackers with a complete compromise vector. The first flaw allows attackers to circumvent authentication checks on specific endpoints, while the second enables arbitrary file write operations. Together, they form a pre-authentication remote code execution chain that requires no user interaction.
This discovery follows a pattern of critical vulnerabilities affecting print management systems, an often-overlooked attack surface in enterprise environments. Print servers frequently operate with high privileges, maintain persistent network connectivity, and interact with numerous endpoints, making them attractive targets for lateral movement and persistence.
Technical Breakdown
The exploitation chain consists of two distinct vulnerabilities working in concert:
Authentication Bypass (CVE-2023-27350)
The first vulnerability exists in PaperCut’s built-in authentication mechanism. Specific API endpoints fail to properly validate authentication tokens, allowing unauthenticated attackers to access restricted functionality. The flaw lies in the improper implementation of the authentication filter chain, where certain code paths bypass verification checks entirely.
Attackers can exploit this by crafting requests to specific endpoints with manipulated parameters that cause the authentication logic to incorrectly assume valid credentials. The vulnerable endpoints include administrative functions that should be strictly protected.
Example vulnerable request pattern:
POST /app HTTP/1.1
Host: papercut-server:9191
Content-Type: application/x-www-form-urlencoded
service=direct/1/SetupCompleted/$Form&sp=S0
Path Traversal Leading to RCE (CVE-2023-27351)
The second vulnerability involves insufficient input validation on file path parameters within the application’s setup configuration process. Once authentication is bypassed via the first vulnerability, attackers can leverage this path traversal weakness to write arbitrary files to the server filesystem.
By manipulating file path parameters with directory traversal sequences, attackers can write malicious files to locations where they will be executed by the server. This typically involves dropping executable scripts, JSP files, or other server-side code that the application server will process.
Example exploitation payload:
import requests
target = "http://vulnerable-papercut:9191"
payload = {
'service': 'direct/1/SetupCompleted/$Form',
'sp': 'S0',
'file': '../../../path/to/webroot/shell.jsp',
'content': '<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>'
}
response = requests.post(f"{target}/app", data=payload)
The chained exploitation allows complete server compromise within seconds, granting attackers the ability to execute system commands, exfiltrate sensitive data, and establish persistence mechanisms.
Impact & Risk Assessment
The severity of this vulnerability chain cannot be overstated. Organizations face several critical risks:
Immediate Compromise: Attackers can achieve complete system control without any authentication, credentials, or user interaction. This represents the most severe category of vulnerability.
Lateral Movement: Compromised PaperCut servers often operate in trusted network zones with access to Active Directory, file shares, and print infrastructure across the organization. Attackers can pivot from print servers to broader network assets.
Data Exposure: PaperCut systems store extensive metadata about print jobs, potentially including sensitive document contents, user information, and organizational structure data.
Ransomware Deployment: The ability to execute arbitrary code makes these systems ideal initial access vectors for ransomware operators. Several ransomware groups have historically targeted print management infrastructure.
Persistence: Attackers can modify configuration files, install backdoors, and create rogue administrative accounts that survive system reboots and even some remediation efforts.
Organizations in education, healthcare, and government sectors face elevated risk due to the prevalence of PaperCut deployments in these environments. The public-facing nature of many PaperCut installations further amplifies the risk, as attackers can identify and exploit vulnerable systems through internet scanning.
Vendor Response
PaperCut responded swiftly to the vulnerability disclosure, releasing patched versions within their coordinated disclosure timeline. The vendor published security bulletin SB-2023-001 detailing the vulnerabilities and providing specific version guidance.
Patched versions include:
- PaperCut NG/MF version 20.1.7
- PaperCut NG/MF version 21.2.11
- PaperCut NG/MF version 22.0.9
The vendor has emphasized the critical nature of these vulnerabilities and strongly recommends immediate patching. PaperCut also released a script to help administrators identify potentially compromised systems by checking for indicators of exploitation in log files.
The vendor’s security advisory provides detailed upgrade instructions and acknowledges the coordinated disclosure by security researchers who responsibly reported the vulnerabilities.
Mitigations & Workarounds
Organizations unable to immediately patch should implement the following temporary mitigations:
Network Segmentation: Restrict network access to PaperCut servers using firewall rules. Only allow connections from trusted IP ranges and required network segments.
# Example iptables rule to restrict access
iptables -A INPUT -p tcp --dport 9191 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROPWeb Application Firewall: Deploy WAF rules to block requests containing path traversal patterns and suspicious authentication bypass attempts.
Disable External Access: If the PaperCut web interface doesn’t require internet accessibility, disable external access entirely through network configuration.
Enhanced Monitoring: Implement aggressive logging and monitoring for all access attempts to PaperCut endpoints, particularly administrative functions.
However, these workarounds provide only limited protection. The vulnerabilities exist in the application logic, and determined attackers with internal network access may still exploit them. Patching remains the only complete remediation.
Detection & Monitoring
Organizations should immediately search for indicators of compromise using the following techniques:
Log Analysis: Review PaperCut application logs for suspicious authentication patterns, particularly successful administrative actions without corresponding user authentication events.
# Search for suspicious setup-related requests
grep -i "SetupCompleted" /path/to/papercut/logs/application.log
grep -i "path traversal" /path/to/papercut/logs/application.logFile Integrity Monitoring: Check for unexpected files in the PaperCut web application directories, particularly JSP files, servlets, or scripts that weren’t part of the original installation.
Network Traffic Analysis: Monitor for unusual outbound connections from PaperCut servers, which may indicate command-and-control communication or data exfiltration.
Process Monitoring: Watch for unexpected child processes spawned by the PaperCut application server, particularly command shells or scripting interpreters.
# PowerShell command to check for suspicious processes
Get-WmiObject Win32_Process | Where-Object {$_.ParentProcessId -eq $PaperCutProcessId}User Account Auditing: Review PaperCut administrative accounts for unauthorized additions or privilege escalations.
Organizations should retain extended log histories during the investigation period to support forensic analysis if compromise is discovered.
Best Practices
Beyond immediate patching, organizations should adopt these security practices for print management infrastructure:
Minimize Exposure: Print management systems should never be directly exposed to the internet. Place them behind VPNs or zero-trust network access solutions.
Principle of Least Privilege: Run PaperCut services with minimal necessary permissions rather than administrative privileges where possible.
Regular Patching Cadence: Establish a consistent patch management process for all infrastructure software, including often-overlooked systems like print servers.
Network Segmentation: Isolate print infrastructure in dedicated network segments with restricted access to critical business systems.
Multi-Factor Authentication: Where supported, enable MFA for administrative access to print management consoles.
Security Monitoring: Include print management systems in centralized security monitoring and SIEM solutions.
Vulnerability Scanning: Regularly scan print infrastructure for known vulnerabilities using authenticated scanning tools.
Incident Response Planning: Include print management systems in incident response playbooks, as they represent potential initial access vectors.
Key Takeaways
- Two chained vulnerabilities in PaperCut enable unauthenticated remote code execution on vulnerable servers
- Affected versions include all releases prior to 20.1.7, 21.2.11, and 22.0.9
- Exploitation requires no authentication or user interaction, representing critical risk
- Print management systems provide attractive targets for lateral movement and ransomware deployment
- Immediate patching is essential; workarounds provide only limited protection
- Organizations should audit logs for indicators of compromise and implement enhanced monitoring
- Print infrastructure deserves the same security attention as other critical enterprise systems
References
- PaperCut Security Bulletin SB-2023-001
- CVE-2023-27350 – Authentication Bypass Vulnerability
- CVE-2023-27351 – Path Traversal Vulnerability
- PaperCut NG/MF Download and Update Documentation
- CISA Known Exploited Vulnerabilities Catalog
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
