CVE-2023-31292

Vulnerability

An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718). The vulnerability is classified as CWE-613 (Insufficient Session Expiration) and allows a local attacker to perform a 'Back Button Refresh' (also known as Back-Back-Refresh) attack. When a victim logs out, the browser may still cache sensitive data including the username and password in the session history. The application does not properly invalidate the session on logout, leaving credentials accessible in the browser cache. This affects CPTO 6.3.8.6 (#718) as published on 2021-07-06 [1].

Exploitation

An attacker with local access to the victim's computer can initiate the attack by clicking the browser's back button after the victim has logged out. Upon reaching the 'Document Expired' page, the attacker clicks the 'Try Again' and 'Resend' buttons. Using the browser's Web Developer Tools, the attacker can then intercept the cached username and password of the logged-out user. The attack requires no special privileges beyond physical or remote local access to the victim's machine after logout [1].

Impact

Successful exploitation allows the attacker to obtain the victim's credentials, leading to a complete compromise of the victim's account. This results in unauthorized access to the CPTO application with the privileges of the victim, enabling potential data theft, manipulation of cash point and transport data, and further lateral movement within the system. The impact is high in terms of confidentiality and availability [1].

Mitigation

The vendor has acknowledged the vulnerability and fixed it. Users should update CPTO to its current version (beyond 6.3.8.6 (#718)). As of the advisory publication date (2023-12-21), the patch has been available. No workaround is provided in the references [1].