Zendesk Vulnerability Could Have Given Hackers Access to Customer Data

guest · Nov 16, 2022

By Ionut Arghire - November 15, 2022

An SQL injection vulnerability in Zendesk Explore could have allowed a threat actor to leak Zendesk customer account information, data security firm Varonis reports.
Click to expand...

Zendesk Explore is the analytics and reporting service of Zendesk, a popular customer support software-as-a-service solution.

According to Varonis, two vulnerabilities in Zendesk Explore could have allowed an attacker to access conversations, comments, email addresses, tickets, and other information stored in Zendesk accounts with Explore enabled.
Click to expand...

The two issues, however, were reported to Zendesk and patched before they could have any impact on customer data.

“There is no evidence that any Zendesk Explore customer accounts were exploited, and Zendesk started working on a fix the same day it was reported. The company fixed multiple bugs in less than one workweek with zero customer action required,” Varonis reports.
Click to expand...

Varonis: Varonis Threat Labs Discovers SQLi and Access Flaws in Zendesk

By Tal Peleg - November 15, 2022
To exploit the vulnerability, an attacker would first register for the ticketing service of its victim's Zendesk account as a new external user. Registration is enabled by default because many Zendesk customers rely on end-users submitting support tickets directly via the web. Zendesk Explore is not enabled by default but is heavily advertised as a requirement for the analytic insights page.
Click to expand...

guest · Jan 20, 2023

Compromised Zendesk Employee Credentials Lead to Breach
By Becky Bracken - January 20, 2023

It has come to light that the Zendesk software-as-a-service (SaaS) company for customer relationship management (CRM) was compromised in October, exposing client account data to a threat actor, according to an email sent to affected accounts on Jan. 13, 2023.
Click to expand...

The email from Zendesk with the details of the security incident was made public by Coinigy, which provides virtual wallet services and "felt the need to disclose it to our customers," Coinigy's post about the compromise explained.

Zendesk explained in the email to Coinigy that the breach was the result of an SMS phishing campaign targeting Zendesk employees.

"Zendesk determined that Service Data belonging to your coiningy.zendesk.com account may have been in the (exposed) unstructured logging platform data," the email from Zendesk explained. "There is no evidence suggesting the threat actor accessed the Zendesk instance of your coiningy.zendesk.com account at any time."
Click to expand...

Besides applauding Coinigy's decision to publicly share the compromise details, security researcher Jake Williams was not as encouraged by Zendesk's response.

"The disclosure is vague and references 'unstructured data from a logging platform' which could be just about anything," Williams tells Dark Reading. "The disclosure simply doesn't give enough information for any organization to evaluate what (if anything) they need to do in response."
Click to expand...

Log in or Sign up

Zendesk Vulnerability Could Have Given Hackers Access to Customer Data

guest Guest

guest Guest

Log in or Sign up

Zendesk Vulnerability Could Have Given Hackers Access to Customer Data

guest Guest

guest Guest

Useful Searches