CVE-2023-42137

Executive Summary

CVE-2023-42137 is a high-severity vulnerability affecting PAX Android-based Point of Sale (POS) devices running PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier. The flaw allows an attacker with shell access to the device to execute arbitrary commands with high privileges by leveraging malicious symlinks. This is a classic symlink following vulnerability (CWE-59) that can lead to complete compromise of the POS terminal, including data theft, payment manipulation, and persistent backdoor installation. The CVSS score is 7.8 (High), and while the EPSS score is currently 0.0%, the impact on payment security is severe. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in PAX's proprietary Android-based operating system (PayDroid). The supply chain risk is significant because PAX devices are widely deployed in retail and hospitality environments. Compromise of a single device could lead to payment card data exfiltration and lateral movement within a merchant's network.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have shell access to the device.
• Attack Complexity: Low (AC:L) – No special conditions required beyond shell access.
• Privileges Required: High (PR:H) – Shell access implies some level of compromise already.
• User Interaction: None (UI:N) – No user action needed for exploitation.
• Scope: Unchanged (S:U) – The vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full read access to sensitive data.
• Integrity Impact: High (I:H) – Full write access to system files.
• Availability Impact: High (A:H) – Potential for denial of service or device bricking.

Threat Level: High. While the attack requires prior shell access, the impact is total device compromise. In a POS environment, this could lead to payment card skimming, transaction manipulation, and persistent malware installation.

Deep Dive & Mechanics

The vulnerability resides in the way PAX's PayDroid operating system handles symbolic links (symlinks) during privileged operations. Specifically, when a process running with high privileges (e.g., a system service or update mechanism) performs file operations based on user-controlled input, it fails to properly validate whether the target path is a symlink. An attacker with shell access can create a malicious symlink pointing to a critical system file (e.g., /dev/block/mmcblk0 for raw block device access, or /system/bin/su for privilege escalation). When the privileged process follows the symlink, it performs the operation on the attacker-chosen target, leading to arbitrary command execution with the privileges of the vulnerable process.

The core issue is a lack of proper path validation and symlink resolution checks. The vulnerable code likely uses functions like open() or fopen() without first checking if the path is a symlink using lstat() or O_NOFOLLOW flags. This allows an attacker to redirect file operations to any file on the system.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code Pattern (C-like pseudocode):

void process_file(const char *user_path) {
    int fd = open(user_path, O_RDWR); // No O_NOFOLLOW flag
    if (fd < 0) {
        // error handling
    }
    // perform privileged operations on fd
}

Patched Code Pattern (Expected fix):

void process_file(const char *user_path) {
    // First, check if the path is a symlink
    struct stat st;
    if (lstat(user_path, &st) == 0 && S_ISLNK(st.st_mode)) {
        // reject symlink
        return;
    }
    int fd = open(user_path, O_RDWR | O_NOFOLLOW); // Use O_NOFOLLOW
    if (fd < 0) {
        // error handling
    }
    // perform privileged operations on fd
}

The fix involves:

1. Using lstat() to check if the path is a symlink before opening.
2. Using the O_NOFOLLOW flag in open() to prevent following symlinks.
3. Implementing proper path canonicalization to ensure the resolved path is within an allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Shell access to a vulnerable PAX POS device (e.g., via ADB, SSH, or a previous exploit).
• Knowledge of a privileged process that performs file operations based on user input.

Exploitation Steps:

1. Identify a vulnerable privileged process. Look for system services or update mechanisms that read/write files based on user-controlled paths. For example, a log upload service that accepts a file path.

2. Create a malicious symlink. Suppose the vulnerable process writes to /data/local/tmp/output.log. Create a symlink:

   ln -s /system/bin/su /data/local/tmp/output.log
   

3. Trigger the vulnerable operation. Cause the privileged process to write to the symlink path. This will overwrite /system/bin/su with the process's output, potentially replacing it with a malicious binary.

4. Escalate privileges. If the process writes a script or binary, you can now execute it with elevated privileges.

Alternative Exploit (Command Injection via Symlink): If the process reads from a symlink, you can point it to a file containing malicious commands:

echo "id > /data/local/tmp/out.txt" > /tmp/evil.sh
ln -s /tmp/evil.sh /data/local/tmp/input.conf
# Trigger the process to read input.conf

Blue Team

Detection and Prevention:

1. Monitor for symlink creation. Use auditd or inotify to detect creation of symlinks in world-writable directories like /data/local/tmp/.

   auditctl -w /data/local/tmp/ -p wa -k symlink_creation
   

2. Check for unexpected symlinks. Regularly scan for symlinks pointing to sensitive files:

   find /data/local/tmp/ -type l -exec ls -la {} \;
   

3. Harden the device. Remove unnecessary services and restrict shell access. Use SELinux policies to prevent symlink following in privileged contexts.

4. Monitor privileged process behavior. Use strace or sysdig to monitor file operations of critical processes:

   strace -p <PID> -e trace=open,openat,creat
   

Indicators of Compromise (IOCs)

• File System Anomalies:

  • Unexpected symlinks in /data/local/tmp/ or other world-writable directories pointing to system files (e.g., /system/bin/su, /dev/block/mmcblk0).
  • Modified system binaries (check with sha256sum against known good hashes).

• Process Anomalies:

  • Unusual processes running with high privileges (e.g., su, sh).
  • Processes performing file operations on symlink targets.

• Network IOCs:

  • Outbound connections from the POS device to unknown IPs (potential C2).
  • Unusual DNS queries.

• Log Entries:

  • Audit logs showing symlink creation events.
  • System logs showing unexpected file access patterns.

Detection Engineering

YARA Rule

rule CVE_2023_42137_Symlink_Exploit {
    meta:
        description = "Detects malicious symlink creation targeting PAX POS devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-42137"
    strings:
        $symlink_cmd = "ln -s" ascii wide nocase
        $target_su = "/system/bin/su" ascii wide nocase
        $target_dev = "/dev/block/mmcblk0" ascii wide nocase
        $target_system = "/system/" ascii wide nocase
    condition:
        any of ($symlink_cmd) and any of ($target_su, $target_dev, $target_system)
}

Sigma Rule

title: CVE-2023-42137 - Malicious Symlink Creation on PAX POS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symlinks pointing to sensitive system files on PAX POS devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42137
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains: '-s'
        CommandLine|contains:
            - '/system/bin/su'
            - '/dev/block/mmcblk0'
            - '/system/'
    condition: selection
falsepositives:
    - Legitimate system administration activities
level: high
tags:
    - attack.t1204.002
    - cve.2023.42137

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-42137 - PAX POS Potential C2 Traffic"; flow:to_server,established; content:"|2f 64 61 74 61 2f 6c 6f 63 61 6c 2f 74 6d 70 2f|"; distance:0; within:128; classtype:trojan-activity; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices. If possible, disconnect PAX POS devices from the network until a patch is available.
2. Restrict shell access. Disable ADB, SSH, and any other remote shell services on production devices.
3. Monitor for exploitation. Implement the detection rules above to identify potential attacks.

Long-term Fixes:

1. Apply vendor patch. Contact PAX for an updated firmware version that fixes the symlink following issue.
2. Implement file system hardening. Use mount options like nosymfollow on world-writable partitions if supported.
3. Deploy SELinux policies. Create policies that prevent privileged processes from following symlinks in user-writable directories.

Workaround:

• If patching is not possible, remove write permissions from world-writable directories for non-root users, or use a custom init script to periodically clean up unexpected symlinks.

Valters IT