# Critical Vulnerabilities in PaperCut Print Management Software

Unauthenticated access to PaperCut's SetupCompleted page bypasses auth, then disabling script sandboxing yields SYSTEM RCE; exploited in the wild to deploy RMM and miners.

- Payout: Real-world hack
- Severity: critical
- Program: PaperCut MF/NG
- Credited: Huntress
- Disclosed: 2023-04-21
- CVE: CVE-2023-27350, CVE-2023-27351
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software
- Tags: domain:infra impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:misconfiguration vuln:rce

**Target:** PaperCut Application Server web management interface (port 9191)
**Root cause:** The SetupCompleted page is reachable without authentication, granting admin session; admin config keys print-and-device.script.enabled and print.script.sandboxed allow disabling the Rhino sandbox, so printer scripts execute arbitrary Java at global scope on save.
**Steps:**
1. Fetch pre-patch installer via `https://cdn.papercut.com/web/products/ng-mf/installers/ng/$_version_prefix/pcng-setup-$pkgver.$_build.sh`
2. Decompile `pcng-server-22.0.8.war` Java classes; ZDI advisories point to SetupCompleted page
3. Visit `/app?service=page/SetupCompleted` and click Login to obtain admin session without credentials
4. Set `print-and-device.script.enabled=Y` and `print.script.sandboxed=N` in admin config
5. Edit default printer script with Java-executing JavaScript; global scope runs on save, spawning child process under `pc-app.exe` (e.g. PowerShell) as NT AUTHORITY\SYSTEM
**How found:** ZDI public notifications narrowed search to SetupCompleted page; source review of decompiled WAR confirmed unauthenticated admin login, then documentation review showed sandbox config keys could be disabled for Java execution.
**Exploitation:** Attacker hits exposed port 9191, bypasses auth via SetupCompleted, disables script sandboxing, saves malicious printer script to run PowerShell as SYSTEM, then downloads and installs Atera/Syncro RMM MSI for persistence or a Monero miner via encoded PowerShell pulling me1.bat/me2.bat.
**Escalation:** Auth bypass to admin, then sandbox disable to SYSTEM code execution, then RMM install for persistent remote access and potential ransomware foothold.
**Insight:** Admin setup/first-run pages (SetupCompleted) often remain reachable post-install and grant privileged sessions; also check whether 'sandboxed' script engines expose config toggles an admin can flip to escape the sandbox.