A bug on Ford Motor Company’s website allowed for accessing sensitive systems and obtaining proprietary data, such as customer databases, employee records, internal tickets, etc.
The data exposure stemmed from a misconfigured instance of Pega Infinity customer engagement system running on Ford’s servers.
The researchers have disclosed a vulnerability found on Ford’s website which allowed them to peek into confidential company records, databases and perform account takeovers.
The researchers Robert Willis and break3r discovered the vulnerability, with further validation and support provided by members of Sakura Samurai ethical hacking group—Aubrey Cottle, Jackson Henry, and John Jackson.
The issue is caused by CVE-2021-27653, an information exposure vulnerability in improperly configured Pega Infinity customer management system instances.
The researchers state that some of the exposed assets contained sensitive Personal Identifiable Information (PII), and included Customer and employee records, Finance account numbers, Database names and tables, OAuth access tokens, Internal support tickets, User profiles within the organization, Pulse actions, Internal interfaces and Search bar history.
Willis stated that the impact huge and that the attackers could use the vulnerabilities identified in the broken access control and obtain sensitive records, perform account takeovers, and obtain a substantial amount of data.
In February 2021, the researchers had reported their findings to Pega that fixed the CVE in their chat portal relatively quickly.
The issue was also reported to Ford around the same time through their HackerOne vulnerability disclosure program.
Although the endpoints were taken offline by Ford within 24 hours of the report, the researchers commented in the same report that the endpoints remained accessible even afterward, and requested another review and remediation.
It is not yet known if any threat actors exploited the vulnerability to breach systems at Ford, or if sensitive customer/employee PII was accessed.