Authentication Bypass in PaperCut NG/MF SecurityRequestFilter

Successful exploitation allows an attacker to bypass the product’s authentication controls and gain unauthorized access to the PaperCut application. In the provided reporting, this flaw has been associated with real-world intrusions in which threat actors obtained unauthenticated access to exposed PaperCut servers and then used that foothold to deploy payloads, steal data, and move laterally within victim environments. Active exploitation in the wild has been reported since early 2023, including use by ransomware operators such as Cl0p/Lace Tempest and LockBit.

If immediate patching is not possible, restrict exposure of the PaperCut management interface by blocking inbound access from external IPs to web management ports 9191 and 9192, block inbound traffic to the web management portal at the firewall, and allow-list only verified Site Server IP addresses in advanced security settings where applicable. More generally, remove internet exposure of PaperCut application servers until patched.

Upgrade PaperCut NG/MF to a vendor-fixed release. The provided content cites patched versions 20.1.7, 21.2.11, and 22.0.9 and later as remediation targets, and advises customers on unsupported older releases to upgrade to a supported version. Apply the vendor-issued security fixes through the normal upgrade process.