CVE-2023-47024
📋 TL;DR
This CSRF vulnerability in NCR Terminal Handler v1.5.1 allows attackers to perform one-click account takeover by exploiting weak security controls in an undisclosed WSDL function. Attackers can craft malicious requests that execute unauthorized actions when victims visit specially crafted web pages. Organizations using NCR Terminal Handler v1.5.1 are affected.
💻 Affected Systems
- NCR Terminal Handler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of terminal handler accounts leading to unauthorized access to sensitive systems, potential data theft, and lateral movement within the network.
Likely Case
Unauthorized account access allowing attackers to modify configurations, access sensitive data, or disrupt terminal operations.
If Mitigated
Limited impact with proper CSRF protections, though other vulnerabilities in the WSDL function might still pose risks.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but is straightforward once the malicious request is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor NCR for security updates and apply immediately when released.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests in the Terminal Handler application.
Restrict WSDL Access
allDisable or restrict access to the vulnerable WSDL function if not required for operations.
🧯 If You Can't Patch
- Implement network segmentation to isolate Terminal Handler from untrusted networks
- Deploy web application firewall (WAF) with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running NCR Terminal Handler v1.5.1 and review WSDL functions for weak security controls on custom content types.Check Version:
Check application documentation or configuration files for version informationVerify Fix Applied:
Verify that CSRF tokens are implemented and WSDL functions have proper security controls when updates become available.📡 Detection & Monitoring
Log Indicators:
- Unusual account access patterns
- Requests to WSDL functions with custom content types
- Failed authentication attempts followed by successful ones
Network Indicators:
- HTTP POST requests to Terminal Handler endpoints without CSRF tokens
- Requests with unusual content-type headers
SIEM Query:
source="terminal_handler" AND (http_method="POST" AND NOT csrf_token=*) OR (content_type="custom/*")🔗 References
- https://docs.google.com/document/d/18EOsFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharing
- https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47024
- https://docs.google.com/document/d/18EOsFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharing
- https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47024
