Security researchers have been able to access company records and confidential employees, customer databases, internal tickets and more on the Ford website due to a bug in the manufacturer’s CRM software.
As noted by BleepingCompactor, the Robert Willis and Break3R safety researchers first discovered the vulnerability on the company’s website before making members of the Sakura Samurai ethical hacking group for additional help.
The bug itself, followed as CVE-2021-27653, is a vulnerability of exposure of information that exists in poorly configured PEGA Infinity instances running on Ford servers. In order to exploit it, however, an attacker would first need to access the Backend Web panel of an access group portal instance to the PEGA key set.
In a blog article, Robert Willis provided new perspectives on the impact of vulnerability and how it allowed security researchers to take control of the account, saying:
“The impact was great at the scale. The attackers could use the vulnerabilities identified in the broken access control and obtain trutures of sensitive recordings, perform repetitions and obtain a substantial amount of data. “
Disclosure of vulnerability
While safety researchers reported their conclusions to FEBS of this year and that the company quickly addressed the vulnerability in their discussion portal, Ford was not as cooperative when the question was reported to the manufacturer with its program of disclosure of vulnerability.
John Jackson of Sakura Samurai explained in an email to BleepingCompactor at some point, Ford has stopped answering the questions of the security researcher. In fact, Hackerone had to intervene to obtain an initial response to their submission of vulnerability to society.
However, it was not until the security researchers tweeted on the vulnerability on the Ford website without mentioning sensitive details before they return from HackerOne.
In the end, safety researchers had to wait a full six months before disclosing the vulnerability themselves because of Hackerone’s policy. It should be noted that Ford does not have a bug premium program, there was no monetary incentive to disclose vulnerability. Instead, they concerned it by the automaker’s customers.
At this point, it is still unclear that cybercriminals or any other third parties have acquired access to the sensitive society and customer data exposed on the Ford website as a result of vulnerability.
