Attack Chain

1. Attacker identifies a vulnerable PaperCut NG/MF instance accessible over the network.
2. The attacker crafts a malicious HTTP request targeting the SecurityRequestFilter class.
3. The crafted request exploits the improper authentication vulnerability (CVE-2023-27351), bypassing normal authentication checks.
4. Upon successful authentication bypass, the attacker gains unauthorized access to the PaperCut NG/MF application with elevated privileges.
5. The attacker leverages the gained access to upload malicious scripts or binaries to the PaperCut server.
6. The attacker executes the uploaded payload, initiating the ransomware encryption process or other malicious activities.
7. Ransomware encrypts sensitive data on the PaperCut server and potentially spreads to other connected systems.
8. The attacker demands a ransom payment for the decryption key.

Impact

Successful exploitation of CVE-2023-27351 allows attackers to bypass authentication, gain unauthorized access, and potentially deploy ransomware. This can result in significant data loss, disruption of print services, and financial losses due to ransom demands and recovery efforts. The vulnerability is known to be actively exploited, increasing the risk to organizations using affected PaperCut NG/MF installations.

Recommendation

• Apply mitigations provided by PaperCut, referencing their knowledge base articles PO-1216 and PO-1219.
• Deploy the Sigma rules provided below to detect potential exploitation attempts against the SecurityRequestFilter class.
• Follow applicable BOD 22-01 guidance for cloud services if the PaperCut instance is cloud-hosted.