CVE-2023-27351

What it actually does

CVE-2023-27351 is a network-exploitable authentication bypass in PaperCut NG/MF. The flaw is in the SecurityRequestFilter authentication logic, allowing a remote unauthenticated attacker to cause protected application functionality to be treated as accessible without a valid login session. The CVSS vector indicates no privileges or user interaction are required and the primary impact is confidentiality: an attacker may access sensitive PaperCut administrative or application data that should require authentication. Because PaperCut servers often integrate with directory services, print infrastructure, user identities, and operational workflows, successful exploitation can expose information useful for broader compromise. This vulnerability is in CISA KEV, has a high EPSS score, and is associated with active exploitation, including ransomware-related activity.

Why it matters to the business

An exposed vulnerable PaperCut NG/MF server can allow attackers to access sensitive print-management information without credentials. This may expose user, device, print, and configuration data and can help attackers understand internal infrastructure for follow-on attacks. Because the vulnerability is listed in CISA KEV, has high exploitation probability, and is marked as used in ransomware campaigns, organizations should treat internet-facing PaperCut servers as high-priority systems for urgent remediation and compromise assessment. Operationally, exploitation can lead to incident response activity, print-service disruption during containment, potential credential and identity review, and regulatory or contractual notification analysis if sensitive data was exposed.

How an attack unfolds

An attacker first identifies a PaperCut NG/MF application server, commonly by scanning for exposed PaperCut web interfaces on standard PaperCut service ports or by fingerprinting HTTP responses. If the server is running an affected build, the attacker sends crafted unauthenticated HTTP requests that abuse the flawed SecurityRequestFilter authentication decision. The application incorrectly allows access to functionality or data that should require an authenticated session. The attacker can then enumerate sensitive application information and use what is learned to support lateral movement, credential targeting, or pairing with other PaperCut vulnerabilities and post-exploitation techniques. In real-world campaigns, PaperCut exploitation has been used as an initial access path and has been associated with ransomware operations, so exploitation should be investigated beyond the web request itself.

How to fix it

Upgrade PaperCut NG/MF to a vendor-supported release that fixes CVE-2023-27351. If an immediate upgrade is not possible, restrict access to the PaperCut web interface to trusted administrative networks or VPNs, block direct internet exposure, and apply compensating controls such as firewall allowlisting, reverse-proxy access controls, and strong monitoring. Because the vulnerability is in CISA KEV and is associated with ransomware activity, remediation should not be limited to patching: review PaperCut application logs, web access logs, administrative audit logs, and endpoint telemetry for evidence of prior exploitation. Rotate or review credentials and service accounts associated with PaperCut if suspicious access is identified. Where PaperCut integrates with directory services or print infrastructure, validate that integration settings and administrative users have not been changed.

How to confirm the fix worked

Confirm the installed PaperCut NG/MF version and build from the administrative console or server files and verify it is newer than the affected release line identified by the vendor for this issue. Confirm that the PaperCut web interface is not directly reachable from untrusted networks unless explicitly required and protected by additional access controls. Review firewall, load balancer, and reverse-proxy rules to ensure only approved sources can reach PaperCut administrative endpoints. Run an authenticated vulnerability scan or vendor-provided version check to confirm the vulnerable build is no longer present. Validate that PaperCut services restarted successfully after upgrade and that printing, authentication integration, user sync, and administrative access continue to function. Finally, review logs before and after remediation to ensure there are no continuing unauthenticated requests to protected application paths.

Typical attack path

1. Discover an exposed PaperCut NG/MF web interface through internet scanning, search-engine indexing, or internal reconnaissance.
2. Fingerprint the PaperCut deployment and version/build where possible.
3. Send unauthenticated HTTP requests crafted to trigger the flawed authentication handling in SecurityRequestFilter.
4. Access protected PaperCut application functionality or sensitive information without a valid login session.
5. Enumerate users, groups, devices, print-related metadata, configuration details, or other application data available through the bypassed access path.
6. Use the exposed information to plan follow-on compromise, including credential attacks, lateral movement, or exploitation of additional PaperCut weaknesses.
7. In higher-impact intrusions, use the compromised PaperCut context as part of broader intrusion activity, including ransomware deployment.

How to detect it

To determine whether exploitation already occurred, review PaperCut application logs, administrative audit logs, web server or reverse-proxy access logs, firewall logs, VPN logs, identity-provider logs, and EDR telemetry from the PaperCut server. Focus on the period before patching and any period when the PaperCut web interface was exposed to untrusted networks. Look for unauthenticated or unusual requests to PaperCut application paths, requests from unfamiliar internet sources, access to administrative pages without corresponding successful login events, abnormal user or group enumeration, and spikes in requests to the PaperCut web interface. Correlate PaperCut access logs with administrative audit events: protected-page access or data retrieval without a preceding valid login is suspicious. Because exploitation has been associated with ransomware activity, also hunt for follow-on behavior on the PaperCut server such as suspicious child processes, unexpected PowerShell or command-shell execution, outbound connections to unfamiliar hosts, new or modified administrator accounts, changed PaperCut configuration, unusual directory synchronization activity, and lateral movement from the PaperCut host. Preserve relevant logs because PaperCut deployments may rotate local logs quickly.

• /app
• /app?service=
• SecurityRequestFilter
• PaperCut NG
• PaperCut MF
• server/logs/server.log
• server/logs/audit.log
• server/logs/request.log
• pc-app.exe
• pc-web-print.exe
• PaperCut Application Server
• GET /app?service=
• POST /app?service=

What your security team should do

• Immediately identify all PaperCut NG/MF servers, especially internet-facing systems, and prioritize them for patching or isolation.
• Upgrade affected PaperCut NG/MF installations to a fixed vendor-supported release as soon as possible.
• Until patched, restrict PaperCut web access to trusted administrative networks only and remove direct internet exposure.
• Perform retrospective threat hunting across PaperCut logs, web access logs, proxy logs, EDR telemetry, and identity logs for suspicious unauthenticated access or unusual PaperCut administrative activity.
• Treat exposed vulnerable PaperCut servers as potentially compromised due to KEV status, high EPSS, active in-the-wild exploitation, and ransomware association.
• Review PaperCut administrator accounts, application configuration, user synchronization settings, directory integration settings, and service accounts for unauthorized changes.
• If suspicious activity is found, preserve logs and forensic artifacts, rotate relevant credentials, investigate adjacent systems, and follow incident response procedures.
• Add monitoring for unexpected access to PaperCut administrative endpoints, anomalous source IPs, unusual user enumeration activity, and PaperCut service behavior inconsistent with normal operations.