Detect CVE-2023-27351 - PaperCut NG/MF Improper Authentication Exploitation in Google Chronicle
Detects exploitation attempts targeting CVE-2023-27351, an improper authentication vulnerability (CWE-287) in PaperCut NG/MF print management software. This CISA KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls, potentially enabling unauthorized access to the PaperCut administration interface and sensitive print management data. Threat actors have actively exploited PaperCut vulnerabilities in the wild for initial access and lateral movement.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2023_27351_papercut_auth_bypass {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2023-27351 PaperCut NG/MF improper authentication exploitation attempts"
severity = "HIGH"
priority = "HIGH"
reference = "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219"
cve = "CVE-2023-27351"
events:
$http.metadata.event_type = "NETWORK_HTTP"
$http.network.http.method = /POST|GET/
$http.network.http.response_code in (200, 302)
$http.target.port in (9191, 9192)
(
$http.network.http.request_url = /\/rpc\/api\/json/
or $http.network.http.request_url = /\/app\?service=/
or $http.network.http.request_url = /\/health-check/
or $http.network.http.request_url = /\/app\/admin/
)
not $http.principal.user.userid = /admin|papercut|svc_/
match:
$http.principal.ip over 5m
outcome:
$risk_score = max(
if($http.network.http.method = "POST" and $http.network.http.response_code = 200, 80, 50)
)
$request_count = count_distinct($http.network.http.request_url)
condition:
#http >= 1
}Chronicle YARA-L rule detecting HTTP requests to PaperCut NG/MF management endpoints on standard ports with successful response codes from non-administrative user contexts, indicating potential CVE-2023-27351 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- PaperCut service accounts performing automated management tasks
- Internal health monitoring systems with unrecognized user identifiers
- Authorized security testing and red team exercises
Other platforms for CVE-2023-27351
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2023-27351 Unauthenticated Health Check Probe
Expected signal: HTTP GET request to /health-check and /api/health on port 9191 from test host IP, HTTP 200 response in web server logs.
- Test 2CVE-2023-27351 Unauthenticated RPC API Call
Expected signal: POST request to /rpc/api/json on port 9191 with Content-Type: application/json header, HTTP 200 response with JSON body in web server logs if vulnerable.
- Test 3CVE-2023-27351 Admin Setup Page Access Attempt
Expected signal: GET request to /app with query parameter service=page/SetupCompleted on port 9191, HTTP response code logged in IIS or PaperCut access logs.
- Test 4CVE-2023-27351 Rapid Sequential Endpoint Enumeration
Expected signal: Multiple sequential HTTP requests to PaperCut endpoints within a short timeframe from a single source IP, visible in web server access logs with timestamps.
Response Playbook
Triage
- Identify the source IP of the request and determine whether it originates from a known internal network range, VPN egress, or an external/untrusted network. External-origin requests are higher priority.
- Review the specific endpoint accessed (e.g., /rpc/api/json, /app?service=SetupCompleted) and the HTTP response code. A 200 OK response to an unauthenticated POST to /rpc/api/json is a strong indicator of successful exploitation.
- Cross-reference the source IP against threat intelligence feeds (known Cl0p, LockBit, or other ransomware-affiliated IPs have previously targeted PaperCut vulnerabilities). Check internal CMDB or asset inventory to determine if PaperCut server was internet-facing.
- Check PaperCut application logs (default: C:\Program Files\PaperCut NG\server\logs\) for corresponding authentication events, user creation events, or script execution entries around the same timestamp.
Containment
- Immediately block the source IP at the perimeter firewall and any WAF rules. If PaperCut is internet-facing, consider placing it behind a VPN or restricting access to authorized IP ranges only.
- If exploitation is confirmed (successful auth bypass observed), isolate the PaperCut server from the network to prevent lateral movement, then initiate the incident response process. Disable the PaperCut web interface temporarily by stopping the PaperCut Application Server service until patching is complete.
Evidence Collection
- Collect PaperCut application server logs from the default log directory (C:\Program Files\PaperCut NG\server\logs\ on Windows or /home/papercut/server/logs/ on Linux) covering the period of the suspected exploitation.
- Capture IIS or web server access logs showing all HTTP requests to PaperCut endpoints for the 48-hour window preceding and following the alert trigger timestamp.
Escalation Criteria
- !Escalate immediately to the incident response team if any successful POST to /rpc/api/json returns 200 OK from an unauthenticated or externally sourced connection, indicating likely successful authentication bypass.
- !Escalate if post-exploitation indicators are observed: new user accounts created in PaperCut, unexpected script execution via PaperCut's scripting interface, or outbound connections from the PaperCut server to external IPs following the initial alert.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PaperCut application log files at C:\Program Files\PaperCut NG\server\logs\server.log (Windows) or /home/papercut/server/logs/server.log (Linux) containing authentication events and RPC calls - >
IIS/web server access logs showing HTTP requests to /rpc/api/json and /app endpoints with source IPs and response codes - >
Windows Event Logs (Security, Application) on the PaperCut host for process creation events, logon events, and service changes that may indicate post-exploitation activity - >
PaperCut database for newly created user accounts, modified admin configurations, or added script hooks
Tuning Guidance
Reduce false positives by building an allowlist of known PaperCut monitoring IPs, service account source addresses, and internal load balancer health check origins. Tune the /app endpoint filter to require the presence of specific query parameters (e.g., service=SetupCompleted or service=page/AdminDashboard) that indicate administrative access rather than general app usage. Increase confidence threshold by combining network-layer detections (connections to port 9191/9192) with application-layer indicators (specific endpoint URIs and response codes). For high-confidence alerting, focus exclusively on POST requests to /rpc/api/json returning 200 OK from external IP ranges, which has minimal legitimate use cases.
Hunting Queries
Broad 7-day hunt for anonymous or unauthenticated POST requests returning HTTP 200 to PaperCut management endpoints, useful for identifying exploitation that preceded detection rule deployment or during initial triage of historical logs.
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/rpc/api/json", "/app", "/health-check")
| where scStatus in (200, 302)
| where csMethod == "POST"
| where isempty(csUsername) or csUsername == "-" or csUsername == "(anonymous)"
| summarize count() by ClientIP, csUriStem, bin(TimeGenerated, 1h)
| order by count_ descindex=web OR index=iis (uri_path="/rpc/api/json" OR uri_path="/app*" OR uri_path="/health-check")
| where (user="-" OR user="" OR isnull(user)) AND status=200 AND method="POST"
| stats count by src_ip, uri_path, _time
| sort -countAtomic Red Team Tests
Simulates initial reconnaissance of a PaperCut server by sending unauthenticated requests to the health-check endpoint to confirm the service is running and identify the version.
Command
curl -sk -o /dev/null -w "%{http_code} %{url_effective}\n" http://TARGET_HOST:9191/health-check && curl -sk http://TARGET_HOST:9191/api/health | python3 -m json.toolCleanup
No cleanup required — read-only probe with no system changes.Expected Telemetry
HTTP GET request to /health-check and /api/health on port 9191 from test host IP, HTTP 200 response in web server logs.
Expected Detection
Should trigger on network-level detections monitoring PaperCut ports; may not trigger application-level detection rules focused on authenticated endpoints without additional tuning.
Simulates the core authentication bypass by sending a POST request to the PaperCut JSON-RPC API endpoint without valid credentials, testing if the server responds with data instead of a 401/403.
Command
curl -sk -X POST http://TARGET_HOST:9191/rpc/api/json -H 'Content-Type: application/json' -d '{"method":"api.getSystemInfo","params":[],"id":1}' -w "\nHTTP Status: %{http_code}\n"Cleanup
No cleanup required — read-only API probe with no persistent changes.Expected Telemetry
POST request to /rpc/api/json on port 9191 with Content-Type: application/json header, HTTP 200 response with JSON body in web server logs if vulnerable.
Expected Detection
Should trigger high-confidence detection rules monitoring POST requests to /rpc/api/json returning HTTP 200 from unauthenticated sessions.
Simulates an attacker attempting to access the PaperCut admin setup completion page without authentication, which could allow configuration manipulation on vulnerable versions.
Command
Invoke-WebRequest -Uri 'http://TARGET_HOST:9191/app?service=page/SetupCompleted' -Method GET -UseBasicParsing | Select-Object StatusCode, StatusDescription, ContentCleanup
No cleanup required — read-only HTTP request with no system changes.Expected Telemetry
GET request to /app with query parameter service=page/SetupCompleted on port 9191, HTTP response code logged in IIS or PaperCut access logs.
Expected Detection
Should trigger detection rules monitoring access to /app?service= endpoints from unauthenticated or external sources.
Simulates an attacker rapidly probing multiple PaperCut management endpoints in sequence, mimicking automated exploitation tooling behavior that appears in incident reports for this CVE.
Command
for endpoint in '/health-check' '/api/health' '/rpc/api/json' '/app?service=page/Dashboard' '/app?service=page/SetupCompleted'; do echo "=== $endpoint ==="; curl -sk -o /dev/null -w "Status: %{http_code}\n" -X GET "http://TARGET_HOST:9191$endpoint"; sleep 1; doneCleanup
No cleanup required — all read-only HTTP requests.Expected Telemetry
Multiple sequential HTTP requests to PaperCut endpoints within a short timeframe from a single source IP, visible in web server access logs with timestamps.
Expected Detection
Should trigger rate-based or sequence-based detection rules identifying rapid enumeration of PaperCut endpoints; individual endpoint hits may trigger low-severity alerts that correlate into a higher-severity finding.