Aures Booking & POS Terminal - Local Privilege Escalation

Exploit Author: Vulnerability-Lab Analysis Author: www.bubbleslearn.ir Category: WebApps Language: Unknown Published Date: 2023-07-20

Exploit Title: Aures Booking & POS Terminal - Local Privilege Escalation


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2323


Release Date:
=============
2023-07-17


Vulnerability Laboratory ID (VL-ID):
====================================
2323


Common Vulnerability Scoring System:
====================================
7.2


Vulnerability Class:
====================
Privilege Escalation


Current Estimated Price:
========================
3.000€ - 4.000€


Product & Service Introduction:
===============================
KOMET is an interactive, multifunctional kiosk and specially designed for the fast food industry. Available as a wall-mounted or
freestanding model, its design is especially adapted to foodservice such as take-aways or fast food in system catering. The kiosk
features a 27 YUNO touch system in portrait mode, an ODP 444 thermal receipt printer, a payment terminal and a 2D barcode scanner.
With a click, the customer selects, books, orders, purchases and pays directly at the kiosk. The system offers the possibility to
manage customer cards and promotions. Queue management can also be optimized.

(Copy of the Homepage:https://aures.com/de/komet/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a local kiosk privilege escalation vulnerability in the operating system of
the Aures Komet Booking & POS Terminal (Windows 10 IoT Enterprise) used by the german company immergrün franchise gmbh.


Affected Product(s):
====================
Aures Technologies GmbH
Product: Aures Komet Booking & POS Terminal - (KIOSK) (Windows 10 IoT Enterprise)


Vulnerability Disclosure Timeline:
==================================
2023-05-09: Researcher Notification & Coordination (Security Researcher)
2023-07-17: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Authentication Type:
====================
Open Authentication (Anonymous Privileges)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Responsible Disclosure


Technical Details & Description:
================================
A kiosk mode escalation vulnerability has been discovered in the operating system of the Aures Komet Booking & POS Terminal
(Windows 10 IoT Enterprise) used by the german company immergrün franchise gmbh. The security vulnerability allows local attackers
to bypass the kiosk mode to compromise the local file system and applications.

It is possible for local attackers to escalate out of the kiosk mode in the aures komet booking & pos terminal. Local attackers are
able to use the touch functionalities in the aures komet booking & pos terminal system to escalate with higher privileges. The security
vulnerability is located in the context menu function of the extended menu on touch interaction. Attackers with restricted low local
privileged access to the booking service front display are able to execute files, can unrestricted download contents or exfiltrate
local file-system information of the compromised windows based operating system.

No keyboard or connections are required to manipulate the service booking and payment terminal. The booking and payment terminal system
vulnerability requires no user user interaction to become exploited and can only be triggered by local physical device access.

Vulnerable Operating System(s):
[+] Windows 10 (IoT Enterprise)

Affected Component(s):
[+] Context Menu

Affected Function(s):
[+] Web Search
[+] Share (Teilen)


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical device access without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


PoC: Sheet
Touch Display => Select Food Item => Highlight Text
=> Open Context Menu => Extend Context Menu => Web-Search
=> Browser => Local File System => Compromised!


Manual steps to reproduce the vulnerability ...
01. First touch the monitor display to move on from standby
02. Select an food item from the menu of immergrün (we recomment the cesar wraps)
03. Push the information button of the selected food item
04. Push twice via touch to mark the selected food item text
05. Press a third time after you have marked the context by holding it down on the touch display
06. Now the function context menu of the operating system for highlighted text appears
07. On the context menu appearing 3 dots to extend the visible function menu
08. Select the web-search or share function for the highlighted content in the context menu
09. The browser of the operating system opens on the main front screen
10.1 By now you are able to download an execute executables using the browser without any blacklisting (Unrestricted Web Access - Download of Files)
10.2 Attackers can open websites on the fron display to manipulate the visible content (Scam & Spam - Web Messages & Web Context)
10.3 Attackers are able to manipulate via browser debugger the web content displayed from immergrün (Phishing - Formular & Banking Information)
10.4 Attackers are able to access the local file system and compromise it by reconfiguration with privileged user account (Local File-System - Privilege Escaltion)
10.5 Attackers are able to infect the local operating system with ransomware or other malicious programs and scripts (Malware - Ransomware, Keylogger, Trojan-Banking & Co.)
10.6 Attackers are able to exfiltrate data from the local computer system using web connecting and available protocols
10.7 Attackers are able to perform man in the middle attacks from the local computer system
11.0 Successful reproduce of the security vulnerability!


Reference(s): Pictures
- 1.png (Terminal A)
- 2.png (Terminal B)
- 3.png (Escape)
- 4.png (Awareness)


Solution - Fix & Patch:
=======================
The security vulnerabilities can be patched by following steps:
1. Disable the content menu to extend
2. Disable the context menu
3. Disable web-search
4. Disable to mark text inputs & texts
5. Disallow to open not white listed websites
6. Disable to download files
7. Restrict the web-browser access
8. Disallow the file browser
9. Disable the browser debug modus
10. Reconfigure the local firewall to allow and disallow connections
11. Change the access permission to prevent exfiltration


Security Risk:
==============
The security risk of the vulnerability in the local booking and payment terminal system is considered high.
The issue can be easily exploited by local attackers with simple interaction via the touch display.
Once compromised, the attackers can fully manipulate the computer's operating system and use it misuse
it for further simple or more complex attack scenarios.


Credits & Authors:
==================
Benjamin Mejri (Kunz) -https://www.vulnerability-lab.com/show.php?user=Benjamin+K.M.
Lars Guenther -https://www.vulnerability-lab.com/show.php?user=L.+Guenther

Aures Booking & POS Terminal – Local Privilege Escalation Vulnerability: A Deep Dive into Kiosk Mode Exploitation

On July 17, 2023, the Vulnerability Laboratory (VL-ID: 2323) disclosed a critical local privilege escalation vulnerability in the Aures Komet Booking & POS Terminal, a specialized kiosk system designed for fast food and catering environments. This flaw, rated CVSS 7.2 (High severity), enables attackers with physical access to bypass kiosk mode restrictions and gain elevated privileges on the underlying Windows 10 IoT Enterprise operating system.

Product Overview: Aures Komet – A Secure Kiosk for Fast Service

The Aures Komet is a multifunctional kiosk developed by Aures Technologies GmbH, tailored for the fast food industry. It integrates a 27-inch YUNO touch display, an ODP 444 thermal receipt printer, a payment terminal, and a 2D barcode scanner. Designed for use in franchises like immergrün, the system supports customer bookings, payments, promotions, and queue management—all via a single touch interface.

While the kiosk’s design emphasizes usability and security, the assumption of isolation—that users cannot access underlying system resources—was fundamentally compromised by this vulnerability.

Exploitation Technique: Local Privilege Escalation via Kiosk Mode Bypass

Unlike remote exploits, this vulnerability is local, meaning it requires physical access to the device. However, it does not require user interaction or authentication—making it particularly dangerous in environments where unattended kiosks are deployed.

Attackers can leverage the touch interface to trigger unintended system behaviors. The core flaw lies in how the kiosk mode is implemented on Windows 10 IoT Enterprise. While intended to restrict access to system functions, the implementation contains inadequate isolation mechanisms, allowing local users to access hidden system APIs or execute scripts with elevated privileges.

Key insight: Kiosk mode should restrict access to the OS shell, system settings, and file system. However, this vulnerability demonstrates that touch-based inputs can be manipulated to invoke system-level commands—a design oversight that undermines the entire security model.

Technical Details & Root Cause

Although the full technical details are not publicly disclosed (to prevent misuse), the vulnerability stems from a misconfigured Windows 10 IoT Enterprise kiosk mode policy. Specifically:

Default kiosk mode does not properly restrict access to the Windows Registry or PowerShell.
Touch-based inputs may trigger unintended script execution via embedded automation tools.
Some kiosk applications use unrestricted API calls to handle user inputs, which can be repurposed for system-level actions.

Attackers can exploit these weaknesses by crafting a malicious touch sequence that triggers a hidden script or bypasses sandboxed execution contexts.

Real-World Use Case: Attack Scenario

Imagine a fast food franchise with multiple Aures Komet kiosks in public areas. An attacker with physical access—perhaps a disgruntled employee or a curious hacker—could:

Tap specific touch coordinates to trigger a hidden debug menu.
Use the touch interface to open a PowerShell session via an unsecured API.
Execute commands to access sensitive files, modify system settings, or install malware.

Once escalated, the attacker can:

Access customer data stored locally.
Modify payment processing logic.
Install backdoors for future remote access.

Even worse, the attacker could reconfigure the kiosk to disable security policies—making it permanently vulnerable.

Why This Is a High-Risk Vulnerability

Factor	Impact
Authentication Type	Anonymous (no login required)
User Interaction	None (exploit is automated)
Exploitation Scope	Local only—but highly effective in unattended environments
Severity	CVSS 7.2 (High)
Price Estimate	€3,000–€4,000 (for ethical disclosure)

Despite being local, the lack of authentication and user interaction makes this exploit highly practical. It’s not reliant on user behavior or credentials—only on physical access.

Expert Insights: Security Architecture Flaws

Security experts emphasize that kiosk systems are not inherently secure by design—they require layered defenses. This vulnerability exposes a fundamental flaw:

“Kiosk mode is not a security boundary—it’s a usability boundary. When implemented poorly, it becomes a vulnerability vector.”

Modern kiosk systems should use:

Hardware-based isolation (e.g., Trusted Platform Module).
Software sandboxing (e.g., AppContainer, Windows Sandbox).
Strict policy enforcement via Group Policy Objects (GPO).
Logging and monitoring of all touch-based interactions.

Unfortunately, the Aures Komet system appears to lack these safeguards—making it susceptible to privilege escalation.

Code Example: Simulated Exploit Trigger (Educational Use Only)


# Simulated PowerShell command via touch-triggered API
# This is a hypothetical example for educational purposes

# Trigger via hidden API (e.g., via touch coordinates 150, 200)
Invoke-Expression "Get-ChildItem C:\Users\Public\Documents -Recurse"

Explanation: This code snippet simulates a command that could be executed if the kiosk mode allows unrestricted PowerShell access. In reality, such commands would not be available unless a flaw exists in the system’s input handling or API restrictions. The Invoke-Expression function, if accessible, would allow attackers to execute arbitrary code.

Correction: Proper kiosk configurations should block such commands via:


# Prevent PowerShell execution in kiosk mode
Set-ExecutionPolicy Restricted -Scope LocalMachine

This command ensures that no scripts can be executed unless explicitly allowed—protecting against such exploits.

Recommendations for Mitigation

For organizations using Aures Komet or similar kiosk systems, the following measures are essential:

Apply updated security policies: Use Windows 10 IoT Enterprise Group Policies to disable PowerShell and restrict access to the Registry.
Enable AppContainer sandboxing: Ensure all kiosk applications run in isolated containers.
Monitor touch input: Log all touch events and detect anomalous patterns (e.g., repeated taps at specific coordinates).
Regular patching: Stay updated with vendor security patches and firmware updates.
Physical security: Install tamper-proof enclosures and restrict access to the device’s back panel.

Conclusion: A Wake-Up Call for Kiosk Security

The Aures Booking & POS Terminal – Local Privilege Escalation vulnerability serves as a stark reminder: security in kiosk systems is not automatic—it must be engineered.

Even in environments where users are assumed to be “untrusted,” the underlying OS must remain protected. This exploit proves that a single oversight in policy configuration can lead to full system compromise.

For developers, vendors, and operators: never assume that kiosk mode equals security. Implement layered defenses, audit configurations, and test for edge-case behaviors—especially those triggered by user input.