PT-2023-21000 · Pax Technology · Pax Technology A930 Paydroid

Saif Aziz + 1 · Publicado 2023-07-05 · Atualizado 2024-12-04 · CVE-2023-27199

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX Technology A930 PayDroid version 7.1.1 Virgo V04.5.02 20220722

Description The issue allows attackers to compile a malicious shared library and use LD PRELOAD to bypass authorization checks. This can be achieved by utilizing the LD PRELOAD environment variable to load a malicious shared library, which can then be used to bypass authorization checks.

Recommendations For PAX Technology A930 PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting the use of the LD PRELOAD environment variable to minimize the risk of exploitation. Additionally, monitor for any suspicious library loading activity to detect potential attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2023-27199

Produtos afetados

Pax Technology A930 Paydroid

Referências · 8

• 🔥❌ https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2023/CVEs/CVE-2023-27199.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-27199 · Aviso do Fabricante
• https://t.me/cvenotify/103024 · Publicação no Telegram
• https://t.me/cvenotify/77774 · Publicação no Telegram
• https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2023 · Nota
• https://t.me/cibsecurity/66025 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27199 · Nota de Segurança
• https://t.me/cvenotify/53694 · Publicação no Telegram