Huntress Details PaperCut Zero-Day Exploitation and Remote Code Execution Chain

Apr 21, 2023 · Original article ↗

Summary

Huntress details active exploitation of PaperCut MF/NG flaws CVE-2023-27351 and CVE-2023-27350, explaining an authentication-bypass-to-SYSTEM RCE chain and observed post-exploitation payloads, including RMM tools and a crypto miner; it urges patching.

Key points

The article reports active exploitation of CVE-2023-27351 and CVE-2023-27350 against vulnerable PaperCut MF/NG versions, with patches available in versions 20.1.7, 21.2.11, and 22.0.9.
Huntress reproduced an authentication bypass through the SetupCompleted page; changing settings and a printer script then enabled Java code execution as SYSTEM.
Huntress observed an Atera remote-management agent deployed after exploitation on April 16, 2023, and found a Truebot sample among related downloads, but did not observe Truebot being used in the identified incident.
In activity seen April 22, a batch script attempted to disable Windows Defender and deploy a Monero crypto miner.
Huntress reported 908 vulnerable Windows hosts among 1,014 hosts running PaperCut across 710 organizations in its protected environments, and said it notified affected organizations.
Huntress recommended upgrading to a patched version; it also described firewall restrictions as partial mitigations for systems that could not be patched.

Article Details

Attack Vectors: Unauthenticated exploitation of PaperCut MF/NG authentication-bypass vulnerabilities provided administrative access to the Application Server.
An attacker could modify the default printer script and disable sandboxing to execute JavaScript with access to the Java runtime, resulting in remote code execution.
Observed post-exploitation activity used PowerShell to download files and install remote-management software.
A later observed attack downloaded batch scripts that attempted to disable Windows Defender and deploy a Monero miner.
Defensive Notes: Upgrade PaperCut to a patched version; the article identifies patched versions 20.1.7, 21.2.11, and 22.0.9, and notes that only versions 20.x or later are patchable.
If patching is not possible, block external traffic to the web management port (9191 by default); consider also blocking other traffic to that port at the server firewall, noting the stated limits of each measure.
Review PaperCut Application Logs for unexpected administrator logins, print-script modifications, or configuration changes, and check debug logs for anomalous access to the SetupCompleted page.
Monitor for unexpected child processes spawned by pc-app.exe, including PowerShell activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`upd488[.]windowservicecemter[.]com`	Attacker-used host for post-exploitation downloads, including an Atera installer and a file identified by Huntress as a Truebot variant.
DOMAIN	`winserverupdates[.]com`	Huntress linked this domain to Cobalt Strike Beacon activity involving a similar-looking upd343 subdomain.
IPV4	`50[.]19[.]48[.]59`	Host serving batch scripts used in observed activity that attempted to disable Windows Defender and deploy a Monero miner.
SHA256	`c0f8aeeb2d11c6e751ee87c40ee609aceb1c1036706a5af0d3d78738b6cc4125`	SHA-256 of ld.txt, which Huntress identified through analysis as a Windows DLL and Truebot variant.
URL	`hxxp[:]//50[.]19[.]48[.]59:82/me1.bat`	First-stage batch-script URL observed in activity that attempted to deploy a Monero miner.
URL	`hxxp[:]//50[.]19[.]48[.]59:82/me2.bat`	Second-stage batch-script URL used by the observed miner-deployment script.
URL	`hxxp[:]//upd488[.]windowservicecemter[.]com/download/setup.msi`	Observed payload-delivery URL used by PowerShell to download an Atera installer after PaperCut exploitation.