CVE-2023-47022

Executive Summary

CVE-2023-47022 is an Insecure Direct Object Reference (IDOR) vulnerability in NCR Terminal Handler v.1.5.1. This flaw allows an unprivileged user to edit audit logs for any user, leading to potential CSV injection attacks. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation probability. No public proof-of-concept or patch is currently available. The vendor, NCR, has not released a fix.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• CVSS Vector: UNKNOWN
• EPSS Score: 0.0% (Low exploitation probability)
• Threat Level: Medium (due to IDOR and CSV injection potential)
• Attack Vector: Network (likely)
• Privileges Required: Low (unprivileged user)
• User Interaction: None
• Impact: Confidentiality (Low), Integrity (High), Availability (Low)

Deep Dive & Mechanics

The vulnerability resides in the audit log editing functionality of NCR Terminal Handler v.1.5.1. The application fails to properly validate user permissions when processing requests to modify audit logs. An attacker can manipulate a direct object reference (e.g., a user ID or log entry ID) to edit logs belonging to other users. This IDOR can be exploited to inject malicious CSV content into log files, which, when exported and opened in spreadsheet software, could execute arbitrary commands (CSV injection).

The attack flow:

1. Authenticate as an unprivileged user.
2. Intercept the request to edit an audit log entry.
3. Modify the object reference (e.g., user_id or log_id) to target another user's log.
4. Inject CSV payload (e.g., =CMD|' /C calc'!A0) into a log field.
5. When an administrator exports and opens the log in Excel, the payload executes.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely lacks authorization checks:

Vulnerable (pseudo-code):

def edit_audit_log(log_id, new_content):
    log = db.get_log(log_id)  # No user ownership check
    log.content = new_content
    db.save(log)

Patched (expected):

def edit_audit_log(log_id, new_content, current_user):
    log = db.get_log(log_id)
    if log.user_id != current_user.id and not current_user.is_admin:
        raise PermissionError("Unauthorized")
    log.content = sanitize_csv(new_content)
    db.save(log)

Exploitation & Lab Setup

Red Team

1. Setup: Deploy NCR Terminal Handler v.1.5.1 in a lab environment.
2. Recon: Identify the audit log editing endpoint (e.g., /api/logs/edit).
3. Exploit:
   • Authenticate as user1.
   • Send a POST request to edit log ID 5 (owned by admin):

     POST /api/logs/edit HTTP/1.1
     Content-Type: application/json
     Cookie: session=user1_session
     
     {"log_id": 5, "content": "=CMD|' /C calc'!A0"}
     

   • If successful, the admin's log is overwritten with the CSV injection payload.
4. Impact: When the admin exports logs and opens them in Excel, the payload executes.

Blue Team

1. Detection: Monitor for unusual API calls to audit log endpoints with mismatched user IDs.
2. Prevention: Implement strict authorization checks and input sanitization.
3. Response: If exploitation is detected, revoke the attacker's session and restore logs from backup.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/logs/edit with log_id values not belonging to the authenticated user.
• Logs: Audit log entries containing suspicious CSV injection patterns (e.g., =, +, -, @ at the start of fields).
• File: Exported CSV files with formulas like =CMD|... or =HYPERLINK(...).

Detection Engineering

YARA Rule

rule CVE_2023_47022_CSV_Injection {
    meta:
        description = "Detects CSV injection patterns in NCR Terminal Handler logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $csv_inject = /^[=+\-@].*CMD|.*HYPERLINK|.*DDE/i
    condition:
        $csv_inject
}

Sigma Rule

title: NCR Terminal Handler IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to edit audit logs for other users
logsource:
    category: application
    product: ncr_terminal_handler
detection:
    selection:
        event: "audit_log_edit"
        user_id|re: "^(?!%current_user_id%).*$"
    condition: selection
falsepositives:
    - Administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-47022 NCR Terminal Handler IDOR Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/logs/edit"; http_uri;
    pcre:"/\"log_id\":\s*\d+/";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

• Immediate: Disable the audit log editing feature if not required.
• Short-term: Implement proper authorization checks (e.g., verify user ownership before allowing edits).
• Long-term: Apply input sanitization to prevent CSV injection (e.g., escape =, +, -, @ characters).
• Workaround: Restrict access to the audit log endpoint via network segmentation or WAF rules.
• Patch: Await an official patch from NCR. Monitor NCR's security advisories.

Valters IT