CVE-2023-27351 - PaperCut NG/MF Improper Authentication Exploitation

let PaperCutPorts = dynamic([9191, 9192]);
let SuspiciousEndpoints = dynamic(["/app", "/api/health", "/rpc/api/json", "/health-check", "/app?service=page/SetupCompleted"]);
union DeviceNetworkEvents, CommonSecurityLog, W3CIISLog
| where TimeGenerated > ago(24h)
| where (
    (csUriStem has_any (SuspiciousEndpoints) and (scStatus in (200, 302, 401, 403) or csMethod == "POST"))
    or (DestinationPort in (PaperCutPorts) and ActionType in ("ConnectionSuccess", "NetworkConnectionEvents"))
  )
| extend IsAuthBypass = (
    csUriStem has "/rpc/api/json" and csMethod == "POST" and scStatus == 200
    and not(csUsername has_any ("admin", "papercut", "svc"))
  )
| extend IsAdminAccess = (csUriStem has "/app" and csUriQuery has "service=" and scStatus == 200)
| where IsAuthBypass or IsAdminAccess
| summarize
    AttemptCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Endpoints = make_set(csUriStem, 10),
    StatusCodes = make_set(scStatus, 5)
  by ClientIP, csUriStem, csMethod, scStatus, Computer
| where AttemptCount >= 1
| extend AlertSeverity = iff(AttemptCount > 5, "High", "Medium")
| project FirstSeen, LastSeen, Computer, ClientIP, csUriStem, csMethod, scStatus, AttemptCount, Endpoints, StatusCodes, AlertSeverity

index=web OR index=iis OR index=proxy sourcetype IN ("iis", "ms:iis:auto", "access_combined", "nginx:plus:kv")
| eval uri_lower=lower(uri_path)
| eval is_papercut_endpoint=if(
    match(uri_lower, "/rpc/api/json|/app\?service=|/health-check|/api/health|/app/admin"),
    1, 0
  )
| where is_papercut_endpoint=1
| eval is_auth_bypass=if(
    match(uri_lower, "/rpc/api/json") AND method="POST" AND status=200
    AND NOT match(src_user, "admin|papercut|svc_"),
    1, 0
  )
| eval is_admin_access=if(
    match(uri_lower, "/app") AND match(uri_query, "service=") AND status=200,
    1, 0
  )
| where is_auth_bypass=1 OR is_admin_access=1
| stats
    count AS attempt_count,
    min(_time) AS first_seen,
    max(_time) AS last_seen,
    values(uri_path) AS endpoints,
    values(status) AS status_codes
  BY src_ip, method, status, host
| eval severity=if(attempt_count > 5, "high", "medium")
| eval alert_name="CVE-2023-27351 PaperCut Auth Bypass Attempt"
| table first_seen, last_seen, host, src_ip, method, status, attempt_count, endpoints, status_codes, severity, alert_name
| sort -attempt_count

sequence by source.ip with maxspan=5m
  [network where
    destination.port in (9191, 9192) and
    network.direction == "inbound" and
    event.action == "connection_attempted"
  ]
  [http where
    url.path : ("/rpc/api/json", "/app*", "/health-check", "/api/health") and
    http.request.method in ("GET", "POST") and
    http.response.status_code in (200, 302) and
    not user.name : ("admin", "papercut*", "svc_*")
  ]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "HTTP Method",
  "HTTP Response Code",
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  COUNT(*) AS attempt_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx')
  AND destinationport IN (9191, 9192)
  AND (
    URL ILIKE '%/rpc/api/json%'
    OR URL ILIKE '%/app?service=%'
    OR URL ILIKE '%/health-check%'
    OR URL ILIKE '%/app/admin%'
  )
  AND "HTTP Response Code" IN (200, 302)
  AND (username IS NULL OR username = '' OR username ILIKE '%anonymous%')
  AND starttime > NOW() - 1 HOURS
GROUP BY sourceip, destinationip, destinationport, URL, username, "HTTP Method", "HTTP Response Code"
HAVING attempt_count >= 1
ORDER BY attempt_count DESC
LAST 60 MINUTES

_sourceCategory=web/iis OR _sourceCategory=web/nginx OR _sourceCategory=web/apache
| parse regex "(?P<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| parse regex "\"(?P<method>GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) (?P<uri_path>[^\s\"]+)" nodrop
| parse regex " (?P<status_code>\d{3}) " nodrop
| parse regex "\"(?P<user_agent>[^\"]+)\"\s*$" nodrop
| where uri_path matches "/rpc/api/json*" or uri_path matches "/app*service=*" or uri_path matches "/health-check*" or uri_path matches "/app/admin*"
| where status_code in ("200", "302")
| where method in ("POST", "GET")
| count as attempt_count by src_ip, uri_path, method, status_code
| where attempt_count >= 1
| sort by attempt_count desc
| fields src_ip, uri_path, method, status_code, attempt_count

rule cve_2023_27351_papercut_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2023-27351 PaperCut NG/MF improper authentication exploitation attempts"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219"
    cve = "CVE-2023-27351"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /POST|GET/
    $http.network.http.response_code in (200, 302)
    $http.target.port in (9191, 9192)
    (
      $http.network.http.request_url = /\/rpc\/api\/json/
      or $http.network.http.request_url = /\/app\?service=/
      or $http.network.http.request_url = /\/health-check/
      or $http.network.http.request_url = /\/app\/admin/
    )
    not $http.principal.user.userid = /admin|papercut|svc_/

  match:
    $http.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($http.network.http.method = "POST" and $http.network.http.response_code = 200, 80, 50)
    )
    $request_count = count_distinct($http.network.http.request_url)

  condition:
    #http >= 1
}

#event_simpleName=NetworkConnectIP4
| filter LocalPort IN (9191, 9192) OR RemotePort IN (9191, 9192)
| join
  (
    #event_simpleName=HttpRequest
    | filter TargetUrl CONTAINS "/rpc/api/json" OR TargetUrl CONTAINS "/app?service=" OR TargetUrl CONTAINS "/health-check"
    | filter HttpStatusCode IN (200, 302)
    | filter HttpMethod IN ("POST", "GET")
  ) [LocalAddressIP4]
| eval papercut_exploit_indicator = if(
    HttpMethod = "POST" AND TargetUrl CONTAINS "/rpc/api/json" AND HttpStatusCode = 200,
    "high_confidence", "medium_confidence"
  )
| stats
    count() AS request_count,
    min(timestamp) AS first_seen,
    max(timestamp) AS last_seen,
    values(TargetUrl) AS accessed_urls
  BY RemoteAddressIP4, LocalAddressIP4, HttpMethod, HttpStatusCode, papercut_exploit_indicator
| sort -request_count