Aures Booking & POS Terminal - Local Privilege Escalation

Document Title:
===============
Aures Booking & POS Terminal - Local Privilege Escalation


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2323

CVE-ID: CVE-2023-3786

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-3786
https://www.cisa.gov/news-events/bulletins/sb23-205
https://vuldb.com/de/?id.235053


Release Date:
=============
2023-07-17


Vulnerability Laboratory ID (VL-ID):
====================================
2323


Common Vulnerability Scoring System:
====================================
7.2


Vulnerability Class:
====================
Privilege Escalation


Current Estimated Price:
========================
3.000€ - 4.000€


Product & Service Introduction:
===============================
KOMET is an interactive, multifunctional kiosk and specially designed for the fast food industry. Available as a wall-mounted or 
freestanding model, its design is especially adapted to foodservice such as take-aways or fast food in system catering. The kiosk 
features a 27 YUNO touch system in portrait mode, an ODP 444 thermal receipt printer, a payment terminal and a 2D barcode scanner. 
With a click, the customer selects, books, orders, purchases and pays directly at the kiosk. The system offers the possibility to 
manage customer cards and promotions. Queue management can also be optimized.

(Copy of the Homepage: https://aures.com/de/komet/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a local kiosk privilege escalation vulnerability in the operating system of 
the Aures Komet Booking & POS Terminal (Windows 10 IoT Enterprise) used by the german company immergrün franchise gmbh.


Affected Product(s):
====================
Aures Technologies GmbH
Product: Aures Komet Booking & POS Terminal - (KIOSK) (Windows 10 IoT Enterprise)


Vulnerability Disclosure Timeline:
==================================
2023-05-09: Researcher Notification & Coordination (Security Researcher)
2023-05-10: Vendor Notification (Data Security Department)
2023-05-16: Vendor Response/Feedback (Data Security Department)
2023-**-**: Vendor Fix/Patch by Check (Service Developer Team)
2023-**-**: Security Acknowledgements (Security Department)
2019-07-17: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Authentication Type:
====================
Open Authentication (Anonymous Privileges)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Responsible Disclosure


Technical Details & Description:
================================
A kiosk mode escalation vulnerability has been discovered in the operating system of the Aures Komet Booking & POS Terminal 
(Windows 10 IoT Enterprise) used by the german company immergrün franchise gmbh. The security vulnerability allows local attackers 
to bypass the kiosk mode to compromise the local file system and applications.

It is possible for local attackers to escalate out of the kiosk mode in the aures komet booking & pos terminal. Local attackers are 
able to use the touch functionalities in the aures komet booking & pos terminal system to escalate with higher privileges. The security 
vulnerability is located in the context menu function of the extended menu on touch interaction. Attackers with restricted low local 
privileged access to the booking service front display are able to execute files, can unrestricted download contents or exfiltrate 
local file-system information of the compromised windows based operating system. The system is directly able to access the internet 
without any global restrictions. Thus allows a local attackers to for example establish a remote connection by rdp or shells to the 
pos terminal and network.

No keyboard or connections are required to manipulate the service booking and payment terminal. The booking and payment terminal system 
vulnerability requires no user user interaction, in some cases it can requires user interaction (phishing) to become exploited and can 
only be triggered by local physical device access.

Vulnerable Operating System(s):
[+] Windows 10 (IoT Enterprise)

Affected Component(s):
[+] Context Menu

Affected Function(s):
[+] Web Search
[+] Share (Teilen)

Possible Attack(s):
[+] Phishing (Payment data / Passwords / PINs)
[+] Malware (Trojan / Ransomware)
[+] Local file system compromise (Exfiltration & manipulation)
[+] Further network attacks to other related services


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical device access without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


PoC: Sheet
Touch Display => Select Food Item => Highlight Text
=> Open Context Menu => Extend Context Menu => Web-Search
=> Browser => Local File System => Compromised!


Manual steps to reproduce the vulnerability ...
01.  First touch the monitor display to move on from standby 
02.  Select an food item from the menu of immergrün (we recomment the cesar wraps)
03.  Push the information button of the selected food item
04.  Push twice via touch to mark the selected food item text
05.  Press a third time after you have marked the context by holding it down on the touch display
06.  Now the function context menu of the operating system for highlighted text appears
07.  On the context menu appearing 3 dots to extend the visible function menu
08.  Select the web-search or share function for the highlighted content in the context menu
09.  The browser of the operating system opens on the main front screen
10.1 By now you are able to download an execute executables using the browser without any blacklisting (Unrestricted Web Access - Download of Files)
10.2 Attackers can open websites on the fron display to manipulate the visible content (Scam & Spam - Web Messages & Web Context)
10.3 Attackers are able to manipulate via browser debugger the web content displayed from immergrün (Phishing - Formular & Banking Information)
10.4 Attackers are able to access the local file system and compromise it by reconfiguration with privileged user account (Local File-System - Privilege Escaltion)
10.5 Attackers are able to infect the local operating system with ransomware or other malicious programs and scripts (Malware - Ransomware, Keylogger, Trojan-Banking & Co.)
10.6 Attackers are able to exfiltrate data from the local computer system using web connecting and available protocols
10.7 Attackers are able to perform man in the middle attacks from the local computer system
11.0 Successful reproduce of the security vulnerability!


Reference(s): Pictures 
- 1.png (Terminal A)
- 2.png (Terminal B)
- 3.png (Escape)
- 4.png (Awareness)


Solution - Fix & Patch:
=======================
The security vulnerabilities can be patched by following steps:
1.  Disable the content menu to extend
2.  Disable the context menu
3.  Disable web-search
4.  Disable to mark text inputs & texts
5.  Disallow to open not white listed websites
6.  Disable to download files
7.  Restrict the web-browser access
8.  Disallow the file browser
9.  Disable the browser debug modus
10. Reconfigure the local firewall to allow and disallow connections
11. Change the access permission to prevent exfiltration


Security Risk:
==============
The security risk of the vulnerability in the local booking and payment terminal system is considered high. 
The issue can be easily exploited by local attackers with simple interaction via the touch display.
Once compromised, the attackers can fully manipulate the computer's operating system and use it misuse 
it for further simple or more complex attack scenarios.


Credits & Authors:
==================
Benjamin Mejri (Kunz) 	- https://www.vulnerability-lab.com/show.php?user=Benjamin+K.M.
Lars Guenther 		- https://www.vulnerability-lab.com/show.php?user=L.+Guenther


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab 
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits 
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do 
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains: 	https://www.vulnerability-lab.com ;	https://www.vuln-lab.com ; https://www.vulnerability-db.com

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other 
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or 
edit our material contact (admin@ or research@) to get a ask permission.

				    Copyright © 2023 | Vulnerability Laboratory - [Evolution Security GmbH]™