Ford bug exposed customer and employee records from internal systems

guest · Aug 15, 2021

Ford bug exposed customer and employee records from internal systems
August 15, 2021
https://www.bleepingcomputer.com/ne...r-and-employee-records-from-internal-systems/

A bug on Ford Motor Company's website allowed for accessing sensitive systems and obtaining proprietary data, such as customer databases, employee records, internal tickets, etc.

The data exposure stemmed from a misconfigured instance of Pega Infinity customer engagement system running on Ford's servers.
Click to expand...

From data exfiltration to account takeovers
This week, researchers have disclosed a vulnerability found on Ford's website that let them peek into confidential company records, databases and perform account takeovers.

The vulnerability was discovered by Robert Willis and break3r, with further validation and support provided by members of Sakura Samurai ethical hacking group—Aubrey Cottle, Jackson Henry, and John Jackson.
The issue is caused by CVE-2021-27653, an information exposure vulnerability in improperly configured Pega Infinity customer management system instances.
Click to expand...

Took six months to 'force disclose'
In February 2021, the researchers had reported their findings to Pega, who fixed the CVE in their chat portal relatively quickly.
But, the researchers told BleepingComputer that communication from Ford was thin and faded as the responsible disclosure timeline progressed:
Click to expand...

Log in or Sign up

Ford bug exposed customer and employee records from internal systems

guest Guest

Log in or Sign up

Ford bug exposed customer and employee records from internal systems

guest Guest

Useful Searches