CVE-2023-3654
📋 TL;DR
This vulnerability allows attackers to bypass origin restrictions by manipulating the Host header in HTTP requests to cashIT! devices. It affects cashIT! devices from PoS/Dienstleistung, Entwicklung & Vertrieb GmbH running versions up to 03.A06rks 2023.02.37.
💻 Affected Systems
- cashIT! devices from PoS/Dienstleistung, Entwicklung & Vertrieb GmbH
📦 What is this software?
Cashit\! by Cashit
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing unauthorized access to sensitive payment data, transaction manipulation, or device takeover.
Likely Case
Unauthorized access to administrative functions or sensitive data stored on the cashIT! device.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation.
🎯 Exploit Status
Exploitation requires only HTTP request manipulation with modified Host headers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 03.A06rks 2023.02.37
Vendor Advisory: https://www.cashit.at/
Restart Required: Yes
Instructions:
1. Contact cashIT! vendor for updated firmware. 2. Backup device configuration. 3. Apply firmware update. 4. Restart device. 5. Verify update successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cashIT! devices from untrusted networks using firewalls or VLANs.
Host Header Validation
allImplement reverse proxy or WAF to validate and sanitize Host headers.
🧯 If You Can't Patch
- Implement strict network access controls to limit HTTP access to trusted IPs only.
- Monitor for suspicious HTTP requests with manipulated Host headers.
🔍 How to Verify
Check if Vulnerable:
Send HTTP request with manipulated Host header to device endpoint and check if origin restrictions are bypassed.Check Version:
Check device web interface or console for firmware version information.Verify Fix Applied:
Test with same Host header manipulation after patch - should be rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusual Host headers
- Access from unexpected origins
Network Indicators:
- HTTP traffic to cashIT! devices with modified Host headers
SIEM Query:
http.host contains unusual patterns AND destination_ip in cashIT!_device_range