EUVD-2023-51421CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3Description
An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a crafted session cookie.
Analysis
CVE-2023-47294 is a session cookie validation flaw in NCR Terminal Handler v1.5.1 that permits authenticated attackers with low privileges to craft malicious session cookies to arbitrarily deactivate, lock, and delete user accounts, resulting in high integrity and availability impact. This vulnerability has a CVSS 8.1 score (High severity) and affects NCR's point-of-sale and terminal management infrastructure; while no public POC or active KEV listing is confirmed from the provided data, the network-accessible nature (AV:N) and low attack complexity (AC:L) make this a material risk for organizations deploying this terminal handler in production environments.
Technical Context
The vulnerability resides in NCR Terminal Handler v1.5.1's session management mechanism, specifically in how the application validates and trusts session cookies for authorization decisions. The root cause maps to CWE-284 (Improper Access Control), indicating insufficient validation of user privileges before performing sensitive account operations. Rather than server-side session state validation or cryptographic verification of cookie integrity, the application likely accepts crafted cookies that can manipulate the authorization context. The terminal handler, commonly deployed in retail and banking point-of-sale environments, processes transactions and manages operator credentials; the cookie-based flaw allows bypassing the normal authentication checks that should gate account management operations. This is a classic insecure deserialization or cookie-tampering scenario where the application trusts client-supplied session data without proper verification (e.g., missing HMAC, no secure flag validation, or inadequate backend session store checks).
Affected Products
NCR Terminal Handler v1.5.1 (primary affected version). CPE string likely: cpe:2.3:a:ncr:terminal_handler:1.5.1:*:*:*:*:*:*:*. Affected platforms include NCR point-of-sale terminals, self-checkout systems, and terminal management servers that run Terminal Handler v1.5.1. Organizations using earlier versions (1.5.0, 1.4.x) and later versions (1.5.2+) require vendor confirmation; the description does not explicitly state whether later versions are patched. Related NCR products (e.g., APTRA Terminal Software, Atleos POS systems) may share the same session handling library and warrant review. Note: vendor advisory and patch version details were not provided in the source data; organizations should consult NCR's security bulletin registry and contact NCR support directly for affected product matrix.
Remediation
Immediate actions: (1) Identify all systems running NCR Terminal Handler v1.5.1 via asset inventory; (2) Contact NCR support for patch availability and confirmed safe versions (e.g., 1.5.2 or later if available); (3) Upon patch release, prioritize deployment in production environments, especially those handling sensitive account operations. Interim mitigations pending patching: (a) Restrict network access to terminal handler interfaces using firewall rules and VPNs; limit access to trusted administrative networks only; (b) Implement session timeout policies and force re-authentication for account management operations; (c) Enforce multi-factor authentication (MFA) for any user account capable of modifying other accounts; (d) Monitor and alert on account deactivation/deletion events, flagging bulk operations; (e) Disable cookie-based session persistence for sensitive operations; require server-side session token validation with HMAC or cryptographic signatures; (f) Conduct session-handling code review focusing on cookie validation, deserialization, and privilege checks. Vendor patches: Status unknown from provided data—verify with NCR security advisories (typically published at ncr.com/security or via vendor mailing lists). After patching, validate through regression testing on non-production systems.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today