PaperCut Alerts Users of Exploited Vulnerability in Print Management Systems

April 20, 2023

Print management solutions provider PaperCut has issued a warning to organizations about the exploitation of a recently patched critical-severity vulnerability in their print management system, PaperCut MF/NG. The vulnerability, tracked as CVE-2023-27350 and having a CVSS score of 9.8, is described as an improper access control issue in the SetupCompleted class of PaperCut MF/NG. Successful exploitation of this security defect allows a remote, unauthenticated attacker to bypass authentication and execute arbitrary code with System privileges.

“We have confirmed that under certain circumstances this allows for an unauthenticated attacker to get remote code execution (RCE) on a PaperCut Application Server. This could be done remotely and without the need to log in,” PaperCut’s advisory reads. The issue affects PaperCut MF and NG versions 8.0 and later. The company patched the bug in March 2023 with the release of PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, and 22.0.9, and urges customers to update their installations as soon as possible, since exploitation has started. “Please note that as of 18th April, 2023 we have evidence to suggest that unpatched servers are being exploited in the wild,” the company says.

Both application servers and site servers are impacted. PaperCut recommends reviewing server access logs and performing malware scans to identify any signs of suspicious activity resulting from the vulnerability’s exploitation. “If you suspect that your server has been compromised, we recommend taking server backups, then wiping the Application Server, and rebuilding from a ‘safe’ backup point prior to when you discovered any suspicious behavior,” the company notes.

The vulnerability was reported to the vendor by an anonymous researcher through Trend Micro’s Zero Day Initiative (ZDI) in January. No information is available about the attacks exploiting CVE-2023-27350, and it is currently unclear if the flaw was exploited with a zero-day status at some point.

Along with CVE-2023-27350, PaperCut also patched CVE-2023–27351, a high-severity flaw in PaperCut MF or NG versions 15.0 and later, which could allow an attacker to access user information such as usernames, names, emails, office information, and card numbers. “The attacker can also retrieve the hashed passwords for internal PaperCut-created users only. This could be done remotely and without the need to log in,” PaperCut explains. The bug exists within the SecurityRequestFilter class and is the result of an improperly implemented authentication algorithm. This vulnerability, also reported through ZDI, does not appear to be exploited in malicious attacks.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.