Researchers observed a Kiosk mode bypass vulnerability in a remote hotel’s check-in terminal during their stay there while traveling to attend a threat modeling workshop.
The hotel’s terminal operates through the use of the Ariane Allegro Scenario Player. Ariane is an international provider of self-check systems for the hospitality industry, with deployment to more than 3,000 sites across 25 different countries.
The researchers discovered the flaw in the check-in system’s guest search feature, leading to a crash that allowed for unauthorized access to the underlying system.
Kiosk Mode Bypass Grants Access To Hotel’s Windows Desktop
The hotel, which had no check-in staff, relied solely on the self-service check-in terminal running the Ariane Allegro Scenario Player in kiosk mode. Visiting researchers from Pentagrid discovered that the check-in terminal crashed when a single quote character was inserted into its guest search feature.
Upon trying to interact with the terminal screen after the crash, the Windows operating system asks the user if it should wait longer or stop the running task. Selecting the second option halts the kiosk mode application entirely, unexpectedly allowing the team to access the underlying Windows Desktop. The researchers attributed the flaw as an accidental discovery by Martin “O’YOLO” Schobert.
The researchers state that this bypass poses significant risks as attackers with access to the Windows desktop could potentially target a hotel‘s entire network, access stored data (including PII, reservations, and invoices), or create room keys for other hotel rooms by exploiting its RFID room-provisioning functionality. The kiosk mode bypass vulnerability has been rated with a CVSS score of 6.8 (medium).
The researchers specified the following preconditions as necessary for successful exploitation of the vulnerability:
- Physical access to the check-in terminal along with time, depending upon the attack’s preparation.
- The check-in terminal must be in a self-service state, as hotels might enable this option only during specific times or during staff shortage.
According to Ariane Systems, the issue stemmed from the use of outdated versions of its check-in software at the new hotel.
Disclosure Process and Vendor Response
The vulnerability’s discovery led the team to investigate further, finding that a hotel chain from Liechtenstein and Switzerland use the check-in terminal for smaller hotel locations. The vulnerability could potentially affect several hotels that rely on Ariane’s Allegro Scenario Player check-in system.
The researchers first discovered the vulnerability on March 5, 2024, and immediately attempted to disclose it to the vendor through multiple channels, such as LinkedIn, contact numbers and official email addresses.
The researchers also attempted to reach out to the company’s technical leader and chief product officer, finding a delayed response on March 18 in which Ariane Systems claimed that the reported systems were legacy software models, and that no personally identifiable information (PII) or exploitable data could be retrieved from the kiosk machine.
However, the researchers dispute the vendor’s claim, stating that the kiosk was designed to produce and keep accessible invoice files. In a later call with Ariane Systems on April 11, further vulnerability details were shared, with the researchers awaiting a response. They state that as of June 5, 2024, there have been no updates from the vendor.
They cite the initial delays and lack of additional updates as reasons for publicly disclosing the vulnerability after a waiting period of 90 days. To mitigate potential risks stemming from the vulnerability, the researchers recommended that hotels using the Ariane Allegro Scenario Player check to make sure they have the most recent version of the software installed, as the issue was reportedly fixed by the vendor.
Additionally, they advised hotels to isolate check-in terminals to prevent potential bypasses that could allow attackers to compromise hotel networks or underlying Windows systems.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
