PT-2021-11922 · Pax Technology · Paxstore
Published
2021-05-07
·
Updated
2021-05-13
·
CVE-2020-36128
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Pax Technology PAXSTORE versions 7.0.8 20200511171508 and lower
Description:
The issue allows an attacker to intercept HTTPS traffic from the application store, collect the request responsible for assigning the
X-Terminal-Token to the terminal, and craft an X-Terminal-Token pretending to be another device. This enables the attacker to authenticate its own payment terminal in the application store through token impersonation. Each payment terminal has a session token, called X-Terminal-Token, to access the marketplace, which allows the store to identify the terminal and make available the applications distributed by its reseller.Recommendations:
For versions 7.0.8 20200511171508 and lower, consider disabling the use of the
X-Terminal-Token until a patch is available to prevent token impersonation. Restrict access to the application store to minimize the risk of exploitation. Avoid using the X-Terminal-Token for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Paxstore