PaperCut NG/MF Authentication Bypass and Remote Code Execution Vulnerability Advisory (CVE-2023-27351)

1. Apply Official Security Patches

Immediately upgrade your PaperCut installations to the patched versions: 22.0.9, 21.2.11, 20.1.10, or later.

2. Network Access Control (Temporary Mitigation)

If patching cannot be applied immediately, restrict network access to the PaperCut administration ports (9191/TCP and 9192/TCP) at the firewall level to allow access only from trusted administrative subnets.

# Example: Block external access to port 9191/9192 using iptables
iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 9191 -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP

3. WAF (Web Application Firewall) Rules

Deploy WAF rules to detect and block suspicious requests targeting the setup completion or direct page bypass vectors:

• Target URI Patterns: Look for requests containing /app?service=page/SetupCompleted or unauthorized access to /app?service=direct/ without valid session tokens.

This vulnerability (CVE-2023-27351) exists within the SecurityRequestFilter class of PaperCut NG/MF due to an improper implementation of the authentication algorithm. An attacker can exploit this flaw by crafting specific HTTP requests to bypass the authentication check entirely and obtain an active administrator session.

Once administrative access is gained, the attacker can leverage built-in printer scripting features to execute arbitrary Java or Python code directly on the hosting operating system. This vulnerability is actively exploited in the wild (listed in CISA KEV) and carries an extremely high EPSS score of 0.94, indicating imminent threat.