Papercut Vulnerability Exploited by Iranian APT Groups

Two Iran-linked Advanced Persistent Threat (APT) groups, called “Mango Sandstorm” aka Mercury or Muddywater, and “Mint Sandstorm” aka Phosphorus or APT35, have been exploiting a CVE-2023-27350 vulnerability to gain unauthorized access. The CVE-2023-27350 is a critical vulnerability in PaperCut MF/NG print management servers. The improper access control in SetupCompleted class allows bypassing the authentication process, which can resulting into the ability to threat actors to execute code in the SYSTEM context. The vulnerability was acknowledged by PaperCut on April 19th and the Proof of Concept (PoC) for this vulnerability has been published.