CVE-2017-5634 in Airline Kiosk
Summary
by MITRE
The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to manipulate the print dialog.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2022
The vulnerability described in CVE-2017-5634 represents a significant security flaw in the airline kiosk system operated by Norwegian Air Shuttle, specifically affecting the user interface authentication mechanism. This issue demonstrates a critical failure in the security architecture of public-facing kiosk systems that handle sensitive booking information. The vulnerability exists within the touch-screen interface design where the intended security controls are bypassed through physical proximity attacks, allowing unauthorized access to administrative functions and underlying operating system resources. The flaw specifically targets the authentication flow that should require explicit user identification before granting access to booking identification features, creating a pathway for attackers to escalate privileges without proper authorization.
The technical implementation of this vulnerability stems from inadequate input validation and insufficient access controls within the kiosk's graphical user interface layer. Attackers can exploit the touch-screen print icon functionality to manipulate the print dialog window, which serves as an unintended code execution pathway. This manipulation allows attackers to bypass the standard UI step that should enforce booking identification selection and user authentication. The vulnerability leverages the physical proximity requirement for attack execution, indicating that the kiosk system lacks proper input sanitization and access control enforcement mechanisms. The flaw essentially creates a backdoor through which attackers can gain administrative privileges on the underlying Windows operating system, effectively compromising the entire kiosk infrastructure.
From an operational impact perspective, this vulnerability represents a severe risk to both customer data privacy and organizational security. The ability to bypass authentication and obtain administrative access to the kiosk system means that attackers can potentially access sensitive passenger information, manipulate booking records, and gain network access to internal systems. The vulnerability's physical proximity requirement does not mitigate the risk significantly, as kiosks are typically located in public areas where such attacks can occur without detection. This weakness creates an environment where unauthorized individuals can perform actions that should be restricted to authorized personnel only, potentially leading to data breaches, service disruption, and regulatory compliance violations.
The security implications of CVE-2017-5634 align with common attack patterns documented in the MITRE ATT&CK framework, particularly in the privilege escalation and defense evasion categories. This vulnerability demonstrates characteristics of technique T1068 (Local Port Forwarding) and T1547.001 (Registry Run Keys/Startup Folder) where attackers can establish persistent access through administrative privilege escalation. The flaw also relates to CWE-284 (Improper Access Control) and CWE-352 (Cross-Site Request Forgery) as it involves unauthorized access to system resources and manipulation of user interface elements to bypass intended security controls. Organizations should implement comprehensive security measures including input validation, proper access control enforcement, and regular security testing of public-facing systems to prevent such vulnerabilities from being exploited in real-world scenarios.