PaperCut: CVE-2023-27350

On 8 March 2023, a patch for CVE-2023-27350 (opens in new tab) was released. The CVE details an authentication bypass in the PaperCut NG/MF application, a web-based software used by enterprise organisations to manage their printers and printing processes. The vulnerability allows any threat actor to remotely gain admin access to the web application and abuse the legitimate scripting functionality in the application to achieve remote code execution as SYSTEM on the server.

The issue, however, was that in the subsequent months that followed, active exploitation (opens in new tab) of this issue was seen in the wild. There has also been a steady increase (opens in new tab) in exploitation, including malware delivery with C2 frameworks such as CobaltStrike and even ransomware! The groups behind the active exploitation include prominent Advance Persistent Threats (APTs) such as the Cl0p ransomware group (opens in new tab).

Exploitation has seen such a significant uptick because this is a zero-click exploit. It can be fully scripted for automated malware delivery if the target system is vulnerable. In this room, we will explain the vulnerability, show how it can be exploited, how it can be defended against, and the fundamental security principle that this issue raised again, that proper cleanup after an installation is vital!

Starting the VM

To deploy the attached VM, press the green Start Lab Machine button at the top of the task. The machine will take about 5 minutes to load. Make a note of MACHINE_IP, as this will be the IP for your specific vulnerable machine.

To attack this target, you can either use the AttackBox by pressing the Start AttackBox button or use your own attack machine by connecting to the TryHackMe VPN. You can verify that your vulnerable machine has booted by navigating to http://MACHINE_IP:9191.