Multiple Flaws Found in ScrutisWeb Software Exposes ATMs to Remote Hacking

Four security vulnerabilities in the ScrutisWeb ATM fleet monitoring software made by Iagona could be exploited to remotely break into ATMs, upload arbitrary files, and even reboot the terminals.

The shortcomings were discovered by the Synack Red Team (SRT) following a client engagement. The issues have been addressed in ScrutisWeb version 2.1.38.

ScrutisWeb is a web browser-based solution for monitoring banking and retail ATM fleets, including gleaning information system status, detecting low paper alerts, shutting down or restarting a terminal, and remotely modifying data.

Details of the four flaws are as follows –

• CVE-2023-33871 (CVSS score: 7.5) – A directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the server’s webroot.
• CVE-2023-35189 (CVSS score: 10.0) – A remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
• CVE-2023-35763 (CVSS score: 5.5) – A cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
• CVE-2023-38257 (CVSS score: 7.5) – An insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.

The most severe of the flaws is CVE-2023-35189, as it enables an unauthenticated user to upload any file and then view it again from a web browser, resulting in command injection.

In a hypothetical attack scenario, an adversary could weaponize CVE-2023-38257 and CVE-2023-35763 to log into the ScrutisWeb management console as an administrator.

Furthermore, CVE-2023-35189 could be used to delete log files on ScrutisWeb to cover up the tracks.

“Additional exploitation from this foothold in the client’s infrastructure could occur, making this an internet-facing pivot point for a malicious actor,” the researchers said.

Source: https://thehackernews.com/