PaperCut MF/NG (CVE-2023-27350): Unauthenticated Remote Code Execution

1. April 2023: The Print Server Nightmare

In early 2023, cybersecurity incident response teams tracked multiple sophisticated ransomware operators (including LockBit, Cl0p, FIN7, and state-backed actors) deploying backdoors across corporate enterprise networks. The initial access vector was Progress PaperCut MF/NG print management software running CVE-2023-27350 (CVSS 9.8), an unauthenticated administrative authentication bypass that allowed remote code execution on the underlying server operating system.

2. CVE Metadata Overview

3. Technical Root Cause: The SetupCompleted Authentication Bypass

PaperCut uses a web application written in Java running inside an embedded Jetty container. When a new installation occurs, an initialization wizard guides the administrator through basic setup. Once completed, the application sets an internal state flag.

However, when a remote user navigated directly to the /app?service=page/SetupCompleted endpoint, the class constructor erroneously initialized a valid administrative session in memory and returned an authenticated session cookie without checking whether the setup was already completed:

GET /app?service=page/SetupCompleted HTTP/1.1
Host: print.enterprise-network.local
User-Agent: Mozilla/5.0

The server responded with an administrative session cookie: JSESSIONID=A8F92BC14E.... An attacker simply used this cookie to navigate to the PaperCut Admin Dashboard at /app?service=page/PrinterList.

4. Escalation: Weaponizing Rhino Scripting for RCE

PaperCut includes a feature called "Print Scripting", allowing administrators to write custom JavaScript executed via the built-in Mozilla Rhino engine to calculate print quotas or route jobs. Because PaperCut ran with NT AUTHORITY\SYSTEM or root privileges, an attacker simply inserted a Java runtime execution hook into a printer's custom script and triggered a test print:

function printJobHook(inputs, actions) {
    var runtime = java.lang.Runtime.getRuntime();
    runtime.exec("powershell.exe -enc JABjAG0AZAAgAD0A...");
}

5. Detection and Remediation Protocol

# Search PaperCut server logs for SetupCompleted access
Select-String -Path "C:\Program Files\PaperCut MF\server\logs\server.log" -Pattern "service=page/SetupCompleted"

# Look for suspicious child processes spawned by pc-app.exe (PaperCut service)
Get-WmiObject Win32_Process | Where-Object {$_.ParentProcessId -eq (Get-Process pc-app).Id}

6. Mandatory Patching & Network Hardening

1. Immediately upgrade PaperCut MF/NG to patched versions: 20.1.7, 21.2.11, 22.0.9, or later.
2. Block inbound WAN access to PaperCut management ports: 9191 (HTTP) and 9192 (HTTPS).
3. Run the PaperCut service under a dedicated, low-privilege service account rather than default LocalSystem.