The infrastructure of Toyota was compromised again, when its global supplier management network was hacked by a researcher.
The security researcher Eaton Zveare has exploited a vulnerability in Toyota’s Global Supplier Preparation Information Management System (GSPIMS) to achieve system admin access to Toyota’s global supplier management network.
The GSPIMS portal allows employees and suppliers to access to ongoing projects, surveys, information on purchases.
A JSON Web Token (JWT) is a sort of session token that represents a user’s valid authenticated session on a website. A user gets a JWT after logging into a website by using his email and password.
The analysis of the GSPIMS app allowed the researcher to discover a function named “GenerataJWT” that allows to generate a JWT based on a provided valid email address without providing any password.
The researcher stated that Corporate Toyota emails are easy to guess as it uses a predictable format ([email protected]) in North America. He easily managed to find Toyota employees with Google queries, he also focused on the research of employees registered in the GSPIMS system. Once he found the employee, Zveare was able to a createJWT HTTP request that returned a valid JWT.
He then used the JWT to access the GSPIMS portal and after gaining access to the platform he discovered an account with system administrator privileges.
After gaining access to a system admin account, he had full access to the system. He got access to information on over 14,000 user accounts, information related to all available projects, surveys, and classified documents.
The researcher concluded that he had discovered a backdoor login mechanism in the Toyota GSPIMS website/application that allowed him to log in as any corporate Toyota user or supplier just by knowing their email.
Zveare reported the flaw to Toyota on November 3, 2022, to which the company confirmed the vulnerability and was fixed on November 23, 2022.
Image Credits : HT Auto
Comments