CVE-2023-47298

Executive Summary

CVE-2023-47298 is an information disclosure vulnerability in NCR Terminal Handler version 1.5.1. A low-level privileged authenticated attacker can query the SOAP API endpoint to enumerate all application users, including their usernames, roles, security groups, and account statuses. This exposure of sensitive user metadata can facilitate further targeted attacks, such as privilege escalation or social engineering. No public proof-of-concept (PoC) or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Network (authenticated, low-privileged)
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (user enumeration)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (information disclosure enabling lateral movement)

Deep Dive & Mechanics

The vulnerability resides in the SOAP API endpoint of NCR Terminal Handler. The API does not properly enforce authorization checks for user enumeration operations. An authenticated attacker with low privileges can craft a SOAP request to retrieve a list of all users, including sensitive attributes such as roles, security groups, and account statuses. This is a classic case of insecure direct object reference (IDOR) combined with insufficient access control.

The SOAP endpoint likely exposes a method like GetAllUsers or ListUsers that returns user objects without verifying that the requester has administrative rights. The attacker can then use this information to identify high-privilege accounts, dormant accounts, or accounts with weak security groups for further exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (NCR Terminal Handler 1.5.1):

<!-- SOAP request that returns all users without authorization check -->
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetAllUsers xmlns="http://ncr.com/terminalhandler">
      <sessionToken>attacker_session_token</sessionToken>
    </GetAllUsers>
  </soap:Body>
</soap:Envelope>

Patched Code (Hypothetical):

<!-- Patched SOAP request with authorization check -->
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetAllUsers xmlns="http://ncr.com/terminalhandler">
      <sessionToken>attacker_session_token</sessionToken>
      <adminToken>required_admin_token</adminToken>
    </GetAllUsers>
  </soap:Body>
</soap:Envelope>

The patch would require the server to validate that the session token belongs to an administrator before returning user data.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify the SOAP endpoint (e.g., https://target/terminalhandler/soap).
2. Authentication: Obtain a low-privileged session token via legitimate login.
3. Exploitation: Send a crafted SOAP request to enumerate users:

   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <GetAllUsers xmlns="http://ncr.com/terminalhandler">
         <sessionToken>LOW_PRIV_TOKEN</sessionToken>
       </GetAllUsers>
     </soap:Body>
   </soap:Envelope>
   

4. Response Parsing: Extract usernames, roles, groups, and statuses from the SOAP response.
5. Post-Exploitation: Use enumerated admin accounts for privilege escalation.

Blue Team

1. Detection: Monitor SOAP API logs for GetAllUsers calls from non-admin sessions.
2. Honeypot: Deploy a fake SOAP endpoint that logs attacker requests.
3. Lab Setup:
   • Install NCR Terminal Handler 1.5.1 in a sandboxed environment.
   • Create test users with varying privileges.
   • Simulate the attack using a SOAP client (e.g., Postman, curl).
   • Verify that low-privileged tokens can enumerate all users.

Indicators of Compromise (IOCs)

• Network: SOAP requests to /terminalhandler/soap with <GetAllUsers> body from non-admin IPs.
• Logs: Repeated GetAllUsers SOAP calls from the same session token.
• User Agent: Custom SOAP clients (e.g., curl, Python requests).
• Response: XML containing <userList> with <username>, <role>, <group>, <status> elements.

Detection Engineering

YARA Rule

rule CVE_2023_47298_SOAP_Enumeration {
    meta:
        description = "Detects SOAP requests attempting to enumerate users in NCR Terminal Handler"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-47298"
    strings:
        $soap_envelope = "<soap:Envelope"
        $get_all_users = "<GetAllUsers"
        $session_token = "<sessionToken>"
    condition:
        all of them
}

Sigma Rule

title: NCR Terminal Handler User Enumeration via SOAP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SOAP requests to GetAllUsers endpoint from non-admin users
author: Valters IT
logsource:
    category: webserver
    product: ncr_terminal_handler
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/terminalhandler/soap'
        cs-body|contains: '<GetAllUsers'
    condition: selection
falsepositives:
    - Legitimate admin queries
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-47298 - NCR Terminal Handler User Enumeration via SOAP";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/terminalhandler/soap"; http_uri;
    content:"<GetAllUsers"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Restrict access to the SOAP endpoint via firewall rules or VPN.
2. Short-term: Implement role-based access control (RBAC) on the GetAllUsers method.
3. Long-term: Upgrade to a patched version when available (currently UNKNOWN).
4. Compensating Controls: Enable logging and alerting on all SOAP API calls.
5. Workaround: Disable the SOAP endpoint if not required.

Valters IT