PaperCut MF / NG CVE-2023-27350 (unauthenticated authentication bypass leading to remote code execution, ransomware-linked, CISA KEV): which versions are fixed and what if the server was exposed?

What it is: CVE-2023-27350 is an improper access control flaw in the setup-completion logic of PaperCut MF and PaperCut NG application servers that lets an unauthenticated attacker bypass login and run code, in some configurations as SYSTEM. PaperCut disclosed it in March 2023, and exploitation in the wild began in April 2023, including by ransomware groups. CISA added it to the KEV catalog on April 21, 2023 and later joined the FBI in a ransomware advisory covering it. Am I affected: - PaperCut MF or NG version 8.0 through 20.1.6, 21.0.0 through 21.2.10, and 22.0.0 through 22.0.8, for Application Servers and Site Servers. - Check the version on the Admin web interface under About, or on the dashboard. Fix: 1. Upgrade to 20.1.7, 21.2.11, 22.0.9 or later, as stated by PaperCut. Prefer a current release so later fixes are included. 2. If you cannot patch at once, PaperCut documented mitigations: block inbound access to the server's web management ports from the internet, firewall the management portal from everything but required hosts, and apply the Allowed site server IP addresses list under the security options. 3. If a server was internet-reachable and unpatched, assume compromise. PaperCut and CISA published detection guidance: review logs for unexpected admin activity, newly configured print scripts or external-command settings, and unusual child processes launched by the PaperCut service. Rebuild if you find anything, restore from clean backups, and rotate credentials stored in PaperCut (directory sync, SMTP, service accounts). Verify: the version page shows a fixed release and the management ports are unreachable from untrusted networks. Sources: https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a https://nvd.nist.gov/vuln/detail/CVE-2023-27350