CVE-2023-27350PaperCut NG/MF auth bypass to remote code execution

What broke

PaperCut NG/MF allowed an unauthenticated caller to reach a setup/scripting surface and execute code (ZDI-CAN-18987). CVE-2023-27351 is the companion improper-authentication ID. Horizon3 published a public PoC. CISA KEV. Bloody/Bl00dy and other ransomware crews used it in April-May 2023. Fixed in 22.0.9 / 21.2.11 / 20.1.7.

Why it matters

Print management is not "facilities software." It binds to AD, stores user sync credentials, and sits on the internal network with a forgotten admin UI. An auth bypass there is an identity foothold that never touches the IdP.

What to do

• Confirm every NG/MF application and site server is past those builds. Hive/Pocket were not affected.
• Rotate the AD account PaperCut uses to sync users.
• Take port 9191/9192 off the internet. Hunt for new admin users and unexpected print-script jobs.

After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

• Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
• Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
• Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
• Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
• Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.

Sources

• NVD: CVE-2023-27350
• PaperCut security vulnerability log, March 2023
• CISA AA23-131A