Ford bug exposed customer and employee records from internal systems

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/ford-bug-exposed-customer-and-employee-records-from-internal-systems/

A bug on Ford Motor Company's website allowed for accessing sensitive systems and obtaining proprietary data, such as customer databases, employee records, internal tickets, etc.

The data exposure stemmed from a misconfigured instance of Pega Infinity customer engagement system running on Ford's servers.

This week, researchers have disclosed a vulnerability found on Ford's website that let them peek into confidential company records, databases and perform account takeovers.

The vulnerability was discovered by Robert Willis and break3r, with further validation and support provided by members of Sakura Samurai ethical hacking group—Aubrey Cottle, Jackson Henry, and John Jackson.

The issue is caused by CVE-2021-27653, an information exposure vulnerability in improperly configured Pega Infinity customer management system instances.

The researchers state that some of the exposed assets contained sensitive Personal Identifiable Information (PII), and included:

• Customer and employee records
• Finance account numbers
• Database names and tables
• OAuth access tokens
• Internal support tickets
• User profiles within the organization
• Pulse actions
• Internal interfaces
• Search bar history

"The impact was large in scale. Attackers could use the vulnerabilities identified in the broken access control and obtain troves of sensitive records, perform account takeovers, and obtain a substantial amount of data," Willis writes in a blog posting.

Ford bug exposed customer and employee records from internal systems

A bug on Ford's website allowed for accessing sensitive systems and obtaining proprietary data, such as customer databases, employee records, internal tickets, etc. The data exposure stemmed from a misconfigured instance of Pega customer engagement system running on Ford's servers.

www.bleepingcomputer.com