CVE-2020-36128 in PAXSTORE
Summary
by MITRE • 05/07/2021
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its reseller. By intercepting HTTPS traffic from the application store, it is possible to collect the request responsible for assigning the X-Terminal-Token to the terminal, which makes it possible to craft an X-Terminal-Token pretending to be another device. An attacker can use this behavior to authenticate its own payment terminal in the application store through token impersonation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/12/2021
The vulnerability identified as CVE-2020-36128 affects Pax Technology PAXSTORE versions 7.0.8_20200511171508 and earlier, representing a critical token spoofing flaw that undermines the authentication mechanisms of payment terminal ecosystems. This vulnerability specifically targets the X-Terminal-Token session token system that serves as the primary authentication mechanism between payment terminals and the application marketplace. The security weakness stems from insufficient token validation and generation practices that allow attackers to intercept and reuse legitimate session tokens. The vulnerability falls under CWE-306, which addresses "Missing Authentication for Critical Function" and specifically relates to improper implementation of session management controls. Attackers can exploit this flaw by capturing HTTPS traffic between terminals and the application store, identifying the specific request that provisions the X-Terminal-Token, and then crafting counterfeit tokens that appear authentic to the system.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete compromise of the terminal ecosystem and potential financial fraud. When an attacker successfully impersonates a legitimate terminal through token spoofing, they gain full access to the application marketplace as if they were operating from that specific device. This enables them to download and install unauthorized applications, potentially including malicious software that could compromise the terminal's integrity, steal sensitive payment data, or disrupt business operations. The vulnerability creates a persistent threat vector that allows attackers to maintain access over extended periods, as the spoofed tokens remain valid until the legitimate terminal's session expires or the token is manually revoked. This represents a significant risk to payment processors and merchants who rely on these terminals for transaction processing, as compromised terminals could lead to unauthorized financial transactions and data breaches.
The technical exploitation of this vulnerability aligns with several tactics described in the MITRE ATT&CK framework, particularly focusing on credential access and privilege escalation techniques. Attackers can leverage this vulnerability as part of a broader attack chain that begins with network traffic interception and progresses through session hijacking and application installation. The weakness demonstrates poor implementation of cryptographic token generation and validation, which violates security best practices outlined in NIST SP 800-63B for authentication token management. Organizations should implement comprehensive network monitoring to detect unusual traffic patterns and token usage, while also ensuring that session tokens are properly validated against known terminal identifiers and that token lifetime management follows established security protocols. The vulnerability highlights the importance of implementing proper transport layer security, including certificate pinning and secure session management practices, to prevent attackers from successfully intercepting and reusing authentication tokens in payment terminal environments.
Mitigation strategies for this vulnerability should include immediate patching of affected PAXSTORE versions to address the token generation and validation flaws, implementation of network segmentation to isolate payment terminal communications, and deployment of advanced intrusion detection systems capable of identifying token spoofing attempts. Organizations must also establish robust token lifecycle management processes that include regular token rotation, proper session timeout configurations, and comprehensive audit logging of all authentication events. The implementation of mutual TLS authentication between terminals and the application store would provide additional protection against this type of attack by ensuring that only legitimate devices can establish secure connections. Security teams should conduct regular vulnerability assessments of their payment terminal ecosystems and implement network traffic analysis tools that can detect anomalous token usage patterns. Additionally, organizations should consider implementing certificate-based authentication mechanisms that provide stronger guarantees of device authenticity than token-based systems alone, thereby reducing the attack surface available to adversaries seeking to exploit session token vulnerabilities.