Detect CVE-2023-27351 - PaperCut NG/MF Improper Authentication Exploitation in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2023-27351, an improper authentication vulnerability (CWE-287) in PaperCut NG/MF print management software. This CISA KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls, potentially enabling unauthorized access to the PaperCut administration interface and sensitive print management data. Threat actors have actively exploited PaperCut vulnerabilities in the wild for initial access and lateral movement.
MITRE ATT&CK
KQL Detection Query
let PaperCutPorts = dynamic([9191, 9192]);
let SuspiciousEndpoints = dynamic(["/app", "/api/health", "/rpc/api/json", "/health-check", "/app?service=page/SetupCompleted"]);
union DeviceNetworkEvents, CommonSecurityLog, W3CIISLog
| where TimeGenerated > ago(24h)
| where (
(csUriStem has_any (SuspiciousEndpoints) and (scStatus in (200, 302, 401, 403) or csMethod == "POST"))
or (DestinationPort in (PaperCutPorts) and ActionType in ("ConnectionSuccess", "NetworkConnectionEvents"))
)
| extend IsAuthBypass = (
csUriStem has "/rpc/api/json" and csMethod == "POST" and scStatus == 200
and not(csUsername has_any ("admin", "papercut", "svc"))
)
| extend IsAdminAccess = (csUriStem has "/app" and csUriQuery has "service=" and scStatus == 200)
| where IsAuthBypass or IsAdminAccess
| summarize
AttemptCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
Endpoints = make_set(csUriStem, 10),
StatusCodes = make_set(scStatus, 5)
by ClientIP, csUriStem, csMethod, scStatus, Computer
| where AttemptCount >= 1
| extend AlertSeverity = iff(AttemptCount > 5, "High", "Medium")
| project FirstSeen, LastSeen, Computer, ClientIP, csUriStem, csMethod, scStatus, AttemptCount, Endpoints, StatusCodes, AlertSeverityDetects suspicious HTTP requests to PaperCut NG/MF endpoints consistent with CVE-2023-27351 authentication bypass attempts, including unauthenticated access to admin RPC endpoints and setup/configuration pages.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PaperCut health check monitoring from known internal IP ranges
- Authorized PaperCut administrators accessing the management interface from expected source IPs
- Automated patch management or vulnerability scanning tools probing PaperCut endpoints
- Load balancer health probes targeting PaperCut service endpoints
Other platforms for CVE-2023-27351
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2023-27351 Unauthenticated Health Check Probe
Expected signal: HTTP GET request to /health-check and /api/health on port 9191 from test host IP, HTTP 200 response in web server logs.
- Test 2CVE-2023-27351 Unauthenticated RPC API Call
Expected signal: POST request to /rpc/api/json on port 9191 with Content-Type: application/json header, HTTP 200 response with JSON body in web server logs if vulnerable.
- Test 3CVE-2023-27351 Admin Setup Page Access Attempt
Expected signal: GET request to /app with query parameter service=page/SetupCompleted on port 9191, HTTP response code logged in IIS or PaperCut access logs.
- Test 4CVE-2023-27351 Rapid Sequential Endpoint Enumeration
Expected signal: Multiple sequential HTTP requests to PaperCut endpoints within a short timeframe from a single source IP, visible in web server access logs with timestamps.
Unlock Pro Content
Get the full detection package for CVE-2023-27351 including response playbook, investigation guide, and atomic red team tests.