CVE-2023-27350

What it actually does

CVE-2023-27350 is an unauthenticated access-control failure in PaperCut NG/MF, specifically associated with the SetupCompleted workflow. A remote attacker can reach administrative functionality without valid credentials and gain the ability to execute arbitrary code on the PaperCut application server. On Windows installations, code execution commonly occurs in the context of the PaperCut service account, which is often LocalSystem/SYSTEM, giving the attacker full host-level control. Successful exploitation can allow credential theft, malware staging, lateral movement, data access through the PaperCut application, and disruption of print services.

Why it matters to the business

This is a critical, internet-exploited vulnerability affecting PaperCut NG and PaperCut MF. Because exploitation requires no authentication and has been used in ransomware activity, exposed or unpatched servers represent an immediate risk of full server compromise, operational disruption to printing services, data theft, and broader network intrusion. The issue is listed in CISA KEV, with a remediation deadline of 2023-05-12 that has long passed, and the EPSS score is effectively maximal, indicating very high real-world exploitation likelihood. PaperCut is commonly deployed as shared infrastructure across schools, enterprises, government, and managed print environments, so compromise can have organization-wide operational impact.

How an attack unfolds

An attacker scans for exposed PaperCut NG/MF administration interfaces, typically over HTTP or HTTPS. If the server is vulnerable, the attacker invokes the vulnerable setup-completion path to bypass authentication and obtain administrative access without valid credentials. From there, the attacker abuses PaperCut administrative capabilities to trigger arbitrary command execution on the application server. On Windows, this often results in commands being launched by the PaperCut application process with SYSTEM-level privileges. Post-exploitation activity may include downloading remote tools, deploying web shells or persistence mechanisms, creating or modifying admin accounts, dumping credentials, installing remote monitoring or management tools, deploying Cobalt Strike or other loaders, staging ransomware, and moving laterally into adjacent systems. This vulnerability has been actively exploited in the wild and associated with ransomware-oriented campaigns, so exploitation should be treated as potential full compromise rather than a simple application login event.

How to fix it

Upgrade PaperCut NG/MF immediately to a fixed release. Vendor-fixed versions for this issue include PaperCut MF/NG 20.1.7, 21.2.11, 22.0.9, and later supported releases. If upgrade cannot be completed immediately, remove public internet exposure to the PaperCut administrative interface, restrict access to trusted administrative networks or VPN, enforce firewall allowlists, and monitor for suspicious administrative activity. Because this vulnerability has been actively exploited, remediation should include both patching and compromise assessment. If suspicious activity is found, rotate credentials that may have been accessible from the server, review PaperCut admin accounts and configuration changes, rebuild the host if integrity is uncertain, and investigate lateral movement from the PaperCut server.

How to confirm the fix worked

Confirm the installed PaperCut NG/MF version is 20.1.7, 21.2.11, 22.0.9, or a later vendor-supported fixed version. Verify the PaperCut administration interface is not exposed directly to the internet unless explicitly required and strongly controlled. Attempt unauthenticated access to the setup-completion endpoint from an untrusted network and confirm it does not grant administrative access or expose setup functionality. Review application logs for prior requests to the vulnerable path and for administrative logins or configuration changes from unexpected IP addresses. Validate that the PaperCut service process is not spawning shells, scripting engines, or network download utilities. Confirm firewall, reverse proxy, VPN, and identity controls restrict administrative access to authorized administrators only.

Typical attack path

1. Identify exposed PaperCut NG/MF servers through internet scanning or internal reconnaissance.
2. Access the PaperCut web administration interface over HTTP or HTTPS.
3. Request the vulnerable SetupCompleted workflow to bypass authentication.
4. Obtain administrative capability in the PaperCut application without valid credentials.
5. Use administrative functionality to execute commands on the PaperCut server.
6. Download and run payloads such as remote access tools, loaders, scripts, or ransomware staging components.
7. Establish persistence, collect credentials, and enumerate the local network.
8. Move laterally or deploy ransomware/data-theft tooling depending on the attacker objective.

How to detect it

Investigate PaperCut application logs, reverse proxy logs, web server access logs, firewall logs, EDR telemetry, Windows Security logs, PowerShell logs, Sysmon logs, and network egress records. Focus on unauthenticated access to the setup-completion workflow, administrative logins from unusual IP addresses, creation or modification of PaperCut administrator accounts, changes to print scripts or server configuration, and unexpected commands launched by the PaperCut application process. On Windows, hunt for pc-app.exe spawning command interpreters, scripting engines, download utilities, installers, remote monitoring tools, or credential-access utilities. Review outbound connections from the PaperCut server to unfamiliar IPs or file-hosting infrastructure shortly after suspicious web requests. Because this vulnerability has been used in ransomware campaigns, also hunt for persistence artifacts such as new services, scheduled tasks, startup-folder files, newly installed RMM agents, Cobalt Strike-like beaconing, credential dumping activity, and rapid file discovery or staging behavior. PaperCut server logs are commonly located under the application server logs directory, such as PaperCut MF or PaperCut NG server/logs/server.log, and should be correlated with endpoint process execution at the same timestamps.

• /app?service=page/SetupCompleted
• GET /app?service=page/SetupCompleted
• POST /app?service=page/SetupCompleted
• SetupCompleted
• User "admin" logged into the administration interface
• logged into the administration interface
• modified the print script
• print script
• C:\Program Files\PaperCut MF\server\logs\server.log
• C:\Program Files\PaperCut NG\server\logs\server.log
• /server/logs/server.log
• C:\Program Files\PaperCut MF\server\bin\win\pc-app.exe
• C:\Program Files\PaperCut NG\server\bin\win\pc-app.exe
• pc-app.exe
• pc-app.exe powershell.exe
• pc-app.exe cmd.exe
• pc-app.exe certutil.exe
• pc-app.exe bitsadmin.exe
• pc-app.exe curl.exe
• pc-app.exe msiexec.exe
• pc-app.exe rundll32.exe
• pc-app.exe wscript.exe
• pc-app.exe cscript.exe
• ParentImage=*\pc-app.exe Image=*\powershell.exe
• ParentImage=*\pc-app.exe Image=*\cmd.exe
• ParentImage=*\pc-app.exe Image=*\certutil.exe
• ParentImage=*\pc-app.exe Image=*\bitsadmin.exe
• ParentImage=*\pc-app.exe Image=*\msiexec.exe

What your security team should do

• Treat all vulnerable, internet-accessible PaperCut NG/MF servers as potentially compromised until investigated.
• Upgrade immediately to PaperCut MF/NG 20.1.7, 21.2.11, 22.0.9, or later supported fixed versions.
• Remove direct internet exposure of the PaperCut administration interface and restrict access using firewall, VPN, or administrative network allowlisting.
• Review PaperCut application logs, web access logs, EDR telemetry, and Windows event logs for evidence of unauthenticated setup access, suspicious admin logins, command execution, or payload download activity.
• Hunt for child processes spawned by the PaperCut application service, especially cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, curl.exe, msiexec.exe, rundll32.exe, wscript.exe, or cscript.exe.
• Rotate PaperCut administrator credentials and any credentials stored on or accessible from the PaperCut server if compromise is suspected.
• Inspect PaperCut admin accounts, print scripts, configuration changes, scheduled tasks, services, startup folders, and remote management tools for unauthorized changes.
• If post-exploitation is confirmed, isolate the server, preserve forensic evidence, rebuild from trusted media where appropriate, and perform enterprise-wide lateral movement and ransomware-prevention hunting.
• Prioritize this vulnerability as emergency remediation because it is CISA KEV-listed, associated with ransomware activity, and has an EPSS score near 1.0.