CVE-2023-27350criticalunder attackransomwareCWE-284

CVE-2023-27350: critical vulnerability in PaperCut NG

Published · Updated

Follow this CVE+ Monitor PaperCut NG+ Monitor PaperCut MF/NG

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon1 day
Published on NVDApr 20
1st PoC+1d
metasploitMar 13
CISA KEV+1d
Action required by CISAfederal deadline: 2023-05-12

Apply updates per vendor instructions.

In short

A flaw in PaperCut NG 22.0.5 allows attackers to skip login and gain full system control without needing credentials. This is critical because it opens the door for anyone on the network to take over the entire server.

Technical detail

The SetupCompleted class in PaperCut NG 22.0.5 (Build 63914) contains an improper access control vulnerability (CWE-284) that allows unauthenticated remote attackers to bypass authentication mechanisms. Exploitation requires network access to the affected service and results in arbitrary code execution with SYSTEM privileges, enabling complete server compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PaperCut · NG
public PoCs found — 32
exploitdbwww.exploit-db.com/exploits/51452unverifiedexploitdbwww.exploit-db.com/exploits/51391unverifiedgithubgithub.com/horizon3ai/CVE-2023-27350★ 57githubgithub.com/imancybersecurity/CVE-2023-27350-POC★ 12githubgithub.com/adhikara13/CVE-2023-27350★ 9githubgithub.com/MaanVader/CVE-2023-27350-POC★ 5githubgithub.com/monke443/CVE-2023-27350★ 4githubgithub.com/Ap0dexMe0/CVE-2023-27350★ 2githubgithub.com/dezso-dfield/CVE-2023-27350★ 0githubgithub.com/0xB0y426/CVE-2023-27350-PoC★ 0githubgithub.com/joaoaugustom/PaperCut-Authentication_Bypass_and_RCE★ 0githubgithub.com/danielissaq/-PaperCut-CVE-2023-27350-★ 0githubgithub.com/ASG-CASTLE/CVE-2023-27350★ 0githubgithub.com/Jenderal92/CVE-2023-27350★ 0githubgithub.com/Royall-Researchers/CVE-2023-27350★ 0githubgithub.com/rasan2001/CVE-2023-27350-Ongoing-Exploitation-of-PaperCut-Remote-Code-Execution-Vulnerability★ 0githubgithub.com/HORKimhab/CVE-2023-27350-CVE-2023-27351★ 0vulncheckvulncheck.com/xdb/c10b926bea25unverifiedvulncheckvulncheck.com/xdb/1c0718580d28unverifiedvulncheckvulncheck.com/xdb/5436303f61faunverifiedvulncheckvulncheck.com/xdb/c6701956d915unverifiedvulncheckvulncheck.com/xdb/bd68c4a2099bunverifiedvulncheckvulncheck.com/xdb/40e9921e9645unverifiedvulncheckvulncheck.com/xdb/e218f81318d4unverifiedvulncheckvulncheck.com/xdb/26313d6db3f2unverifiedvulncheckvulncheck.com/xdb/0d92f5504dc8unverifiedvulncheckvulncheck.com/xdb/a4f5bcde4d6cunverifiedvulncheckvulncheck.com/xdb/b08c040aeb38unverifiedcve_referencepacketstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.htmlunverifiedcve_referencepacketstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.htmlunverifiedcve_referencepacketstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PaperCut NG

In the same product, most dangerous first.

CVE-2023-27351HIGHCVE-2023-27351EPSS 78.1%KEVCVE-2023-39469HIGHPaperCut NG External User Lookup Code Injection Remote Code Execution VulnerabilityEPSS 61.4%CVE-2023-39470HIGHPaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 1.8%