UPDATE: Researchers have published a new proof-of-concept (PoC) that completely bypasses detection measures for exploiting a known vulnerability affecting servers running the PaperCut print management solution. The flaw, tracked as CVE-2023-27350 (CVSS score: 9.8/10), is an improper access control vulnerability that allows remote attackers to bypass authentication and conduct remote code execution (RCE) to execute Windows PowerShell commands or drop malicious Java archive (JAR) files on servers running vulnerable instances of PaperCut NG and MF. This flaw is being actively exploited by multiple threat groups like Cl0p and LockBit to drop ransomware and other malware payloads. In the published PoC, the researchers explain that in previous attacks, whether the threat actors ran PowerShell or dropped JAR files, the activity left distinct digital footprints and logs on the victim machines. These indicators allow the system’s security infrastructure to detect malicious behavior like authentication bypassing. In this PoC, the researchers abuse the “User/Group Sync” feature, which synchronizes the user and group information from sources like Active Directory (AD), making it possible to synchronize user and group information from AD, Lightweight Directory Access Protocol (LDAP), or a custom source. The researchers were able to bypass detection by exploiting the custom directory source feature, which allows the user to specify the authentication program they want to use, which could be any executable. In the PoC, the researchers were able to launch a Python reverse shell on Linux servers and download a custom reverse shell on Windows servers without activating any detection measures. A VulnCheck security researcher named Jacob Baines stated that an attacker with administrator permissions could exploit this flaw in multiple ways. Because of this, system mitigation measures should be robust. To prevent exploitation administrators should not exclusively focus on a single code execution method or set of methods to detect exploitation attempts. This is a dynamic matter that has been quickly changing, and CTIX analysts will continue to monitor the situation, providing relevant updates to our readers in the future.