CVE-2023-42133

Executive Summary

CVE-2023-42133 is a privilege escalation vulnerability affecting PAX Android-based Point of Sale (POS) devices. The flaw resides in improperly configured scripts that allow an attacker with existing shell access and system account privileges to escalate their privileges further, potentially gaining full control over the device. This vulnerability is particularly dangerous in retail and payment environments where POS terminals handle sensitive transaction data. The vendor has released a patch in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226, but the status of patches for other models or firmware branches remains unknown.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue specific to PAX Android POS devices.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – Requires physical or remote shell access to the device.
• Attack Complexity: Low (AC:L) – The exploit does not require special conditions.
• Privileges Required: High (PR:H) – The attacker must already have system account privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full access to sensitive payment data.
• Integrity Impact: High (I:H) – Ability to modify system files or transaction data.
• Availability Impact: High (A:H) – Potential to disrupt POS operations.

Threat Level: Medium. While the CVSS score is moderate, the potential impact on payment systems and the requirement for prior access make it a targeted threat.

Deep Dive & Mechanics

The vulnerability stems from improperly configured scripts within the PAX Android POS firmware. These scripts, likely part of system initialization or maintenance routines, are executed with elevated privileges but contain insecure configurations that allow an attacker to inject or modify commands. The exact mechanism is not publicly disclosed, but typical patterns include:

• Insecure file permissions: Scripts or configuration files writable by the system user that are executed by a higher-privileged process.
• Unvalidated input: Scripts that accept parameters or environment variables without sanitization, allowing command injection.
• SUID/SGID misconfigurations: Executables with setuid/setgid bits that can be abused to run arbitrary code as root.

An attacker with shell access (e.g., via SSH, ADB, or a compromised application) can leverage these scripts to execute arbitrary commands with root privileges, effectively taking full control of the POS device.

Vulnerable vs. Patched Code

Since the exact vulnerable script is not publicly identified, the comparison is based on the patch description.

Vulnerable (Pre-Patch):

# Example of an improperly configured script
#!/system/bin/sh
# Insecure: script runs with elevated privileges but allows user-controlled input
eval "$@"

Patched (Post-Patch):

#!/system/bin/sh
# Secure: input is sanitized and privileges are dropped
if [ -n "$1" ]; then
    # Validate input
    case "$1" in
        allowed_command) exec /system/bin/allowed_command ;;
        *) echo "Invalid command" ;;
    esac
fi

The patch likely involves:

• Removing unnecessary SUID/SGID bits.
• Sanitizing script inputs.
• Restricting execution contexts.
• Updating firmware to version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Shell access to a vulnerable PAX POS device (e.g., via ADB or SSH).
• System account privileges (e.g., system or shell user).

Exploitation Steps:

1. Identify vulnerable scripts:

   find / -type f -perm -4000 -o -type f -perm -2000 2>/dev/null
   

2. Examine script contents for injection points:

   cat /path/to/vulnerable_script.sh
   

3. Exploit the script to escalate privileges:

   # Example: If script uses eval on user input
   /path/to/vulnerable_script.sh "id; /system/bin/sh"
   

4. Confirm root access:

   id
   

Expected Output:

uid=0(root) gid=0(root)

Blue Team

Detection:

• Monitor for unusual process executions from system scripts.
• Alert on commands like id, whoami, or shell spawning from non-interactive contexts.
• Use file integrity monitoring on critical system scripts.

Prevention:

• Apply the firmware patch immediately.
• Restrict shell access to POS devices (disable ADB, SSH, or use strong authentication).
• Implement least privilege principles for all system accounts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder – replace with actual hash of vulnerable script)
• Process Names:
  • /system/bin/sh spawned from unexpected parent processes.
  • id, whoami, su executed from non-interactive shells.
• Network Connections:
  • Outbound connections from POS device to unknown IPs (potential C2).
• Log Entries:
  • audit.log entries showing privilege escalation attempts.
  • logcat entries with su or root commands.

Detection Engineering

YARA Rule

rule CVE_2023_42133_PAX_PrivEsc {
    meta:
        description = "Detects PAX POS privilege escalation scripts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-42133"
    strings:
        $s1 = "eval" ascii wide nocase
        $s2 = "system" ascii wide nocase
        $s3 = "exec" ascii wide nocase
        $s4 = "chmod" ascii wide nocase
    condition:
        uint16(0) == 0x2123 and  // #! shebang
        filesize < 10KB and
        all of ($s*)
}

Sigma Rule

title: CVE-2023-42133 PAX POS Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects privilege escalation attempts on PAX POS devices
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sh'
        CommandLine|contains:
            - 'id'
            - 'whoami'
            - 'su'
            - 'root'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-42133 PAX POS Potential C2"; flow:to_server,established; content:"|00|"; depth:1; content:"|01|"; within:10; classtype:trojan-activity; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Update firmware to PayDroid_8.1.0_Sagittarius_V11.1.61_20240226 or later.
   • If patching is not possible, disable shell access (ADB, SSH) and restrict physical access to devices.

2. Long-term Measures:

   • Implement network segmentation for POS devices.
   • Use endpoint detection and response (EDR) solutions on POS terminals.
   • Regularly audit system scripts for insecure configurations.

3. Compensating Controls:

   • Enable SELinux in enforcing mode.
   • Use application whitelisting to prevent unauthorized script execution.
   • Monitor for anomalous process behavior.

Valters IT