CVE-2023-27351: PaperCut NG/MF Improper Authentication -- SecurityRequestFilter Bypass

Background

PaperCut NG and MF are enterprise print management solutions deployed across universities, hospitals, government agencies, and large corporations to manage, track, and control printing infrastructure. PaperCut MF (Multi-Function) supports copiers and multifunction printers while NG (Next Generation) focuses on standard print queues. Both products are typically installed on Windows or Linux servers and expose a web administration interface.

CVE-2023-27351 is distinct from the more widely publicised CVE-2023-27350 (which allows authenticated script execution). CVE-2023-27351 specifically bypasses the SecurityRequestFilter — the component responsible for enforcing authentication on restricted endpoints — allowing unauthenticated access to functionality that should require administrator credentials. CISA added this vulnerability to the KEV catalogue on 2026-04-20 with Known Ransomware exploitation confirmed. The vulnerability was patched by PaperCut in March 2023 alongside CVE-2023-27350, but organisations that delayed patching remained exposed for years.

Technical Mechanism

PaperCut’s web application uses a filter chain to enforce authentication before serving protected resources. The SecurityRequestFilter is a servlet filter that intercepts requests and redirects unauthenticated users to the login page. CVE-2023-27351 exploits a flaw in how this filter evaluates certain request paths or parameters, allowing an attacker to craft a request that passes through the filter without triggering the authentication check.

The specific bypass mechanism involves path manipulation or request parameter crafting that causes the SecurityRequestFilter to incorrectly classify the request as either already authenticated, or as a path that is exempt from authentication requirements. Once the filter is bypassed:

1. The attacker gains access to restricted application functionality as if they were an authenticated administrator
2. Accessible functionality may include user information disclosure (account names, email addresses, department information stored by PaperCut), configuration data, and print job metadata
3. Depending on the PaperCut version and configuration, additional exploitation may be possible to escalate from information disclosure to code execution

The bypass does not in itself provide the scripted command execution capability of CVE-2023-27350, but the information disclosed can facilitate further attacks — for example, obtaining valid admin credentials or discovering service account configurations.

Real-World Exploitation Evidence

CVE-2023-27351 was added to CISA KEV on 2026-04-20 with Known Ransomware exploitation confirmed. Threat activity around PaperCut in 2023 was substantial:

• Cl0p ransomware and LockBit affiliates were observed exploiting PaperCut vulnerabilities (CVE-2023-27350 and CVE-2023-27351) for initial access during the same spring 2023 campaign period
• Lazarus Group (North Korea) was attributed by FBI/CISA as exploiting PaperCut vulnerabilities for espionage operations against technology and energy sector targets
• The education sector was disproportionately affected — universities often run PaperCut for campus-wide print accounting and are known to have slower patch cycles
• The healthcare sector was also targeted, with patient data exposure a key concern where PaperCut servers stored print job contents

The CISA KEV addition in 2026 reflects continued active exploitation by ransomware operators against organisations that have still not patched the 2023 vulnerabilities.

Impact Assessment

CVE-2023-27351 allows unauthenticated access to restricted PaperCut functionality, directly affecting any organisation with an internet-accessible PaperCut server. An attacker gains access to user account data including names, email addresses, department information, and print job metadata without presenting any credentials. This information can be used to enumerate valid accounts, identify administrative credentials, and facilitate further exploitation — including chaining into CVE-2023-27350’s authenticated script execution to achieve full server compromise. The 9.8 CVSS score reflects the complete absence of any authentication requirement.

The organisational impact varies by sector but is consistently significant. Universities and hospitals, which represent the largest share of PaperCut deployments, are particularly exposed: print job metadata may contain sensitive patient information or research data, and account enumeration can facilitate subsequent phishing campaigns targeting staff. For any organisation, PaperCut server compromise can yield the Windows service account credentials used to run the service — often a domain account — enabling lateral movement. Ransomware groups have used PaperCut as an initial access vector precisely because it combines internet exposure with privileged service account access that accelerates the path to domain-wide encryption.

Affected Versions

Note: Some older version branches (below 20.x) do not receive patches and require upgrade.

Remediation Steps

1. Upgrade PaperCut MF or NG to version 20.1.7, 21.2.11, or 22.0.9 or later — these versions patch both CVE-2023-27350 and CVE-2023-27351
2. If patching is delayed, restrict network access to the PaperCut Application Server (ports 9191 and 9192 by default) to trusted internal IP ranges only
3. Disable external internet access to PaperCut admin interfaces — print management should not be internet-accessible
4. Enable PaperCut’s built-in security hardening features, including IP allow-lists for admin access
5. Review PaperCut logs for unauthenticated access attempts to restricted endpoints:
   • Logs located at [PaperCut install dir]/server/logs/server.log
6. Rotate all PaperCut administrator passwords and service account credentials
7. Check for newly created local OS or domain accounts on the PaperCut server host
8. Assess whether print job data, user information, or configuration data was exfiltrated if the server was exposed

Detection Guidance

PaperCut application logs — server.log in the PaperCut install directory. Look for:

• Requests to /app?service=page/... administrative paths from IP addresses that have not performed a valid login
• HTTP 200 responses to requests that should require authentication
• Bulk data access patterns (many requests in rapid succession for user records or configuration)

Windows Event Logs (if hosted on Windows):

• Event ID 4688: New process creation from PaperCut service process
• Event ID 4720: New user account creation
• Event ID 4625: Failed logon attempts (pre-exploitation reconnaissance)

SIEM query example (Splunk):

index=web_logs sourcetype=papercut_access
| search uri_path="/app*" status=200
| where NOT match(cookie, "JSESSIONID=")
| stats count by src_ip, uri_path
| where count > 10
| sort -count

Network: PaperCut servers should not have internet-facing management interfaces. Any access from external IP addresses to ports 9191/9192 is suspicious.

Timeline

References

• NVD — CVE-2023-27351
• CISA KEV — CVE-2023-27351
• PaperCut Security Advisory — CVE-2023-27351