Two vulnerabilities in an internal API allowed unauthorized access to contacts and chats, exposing the information of 64 million McDonald’s applicants.
Vulnerabilities in the McDonald’s chatbot recruitment platform McHire exposed the personal information of over 64 million job applicants, security researchers Ian Carroll and Sam Curry discovered.
When accessing the platform, prospective McDonald’s employees chat with a bot created by Paradox.ai, which did not remove the default credentials for a test account and failed to properly secure an API that allowed access to the chat interactions of every applicant.
The McHire platform, Carroll explains, enables restaurant owners to log in to view applications, and forces Single Sign-On (SSO) for McDonald’s. However, a sign-in page for Paradox team members allowed logging into a ‘123456’ user account, with the ‘123456’ password.
“It turned out we had become the administrator of a test restaurant inside the McHire system. We could see all of the employees of the restaurant were simply employees of Paradox.ai, the company behind McHire,” Carroll explains.
From the account, the researchers could view in-progress conversations between applicants and the chatbot, and could also intervene at certain stages during the interview process.
Looking at the API that fetched the candidate information, the researchers noticed that it contained an insecure direct object reference (IDOR) weakness, exposing an ID parameter that appeared to be the order number for the applicant. For the researchers’ application, that ID was 64,185,742.
“We tried decrementing this number, and were immediately faced with PII from another McDonald’s applicant (including ‘unmasked’ contact data),” Carroll notes.
According to Carroll, the API essentially provided access to every candidate’s personal information, including their name, address, phone number, email address, candidacy state, and an auth token to log into the consumer UI as that user, allowing access to their raw chat messages.
Carroll and Curry notified Paradox.ai and McDonald’s of the security issues on June 30. The default credentials were revoked the same day and both flaws were resolved by July 1.
“After our outreach reached the appropriate people, the Paradox.ai team engaged with us, emphasized that safeguarding candidate and client data was their top priority, promptly remediated the vulnerability, and committed to further reviews to identify and close any remaining avenues of exploitation,” Carroll notes.
25 Million Users Affected as AI Chat Platform Leaks 300 Million Messages
UK fines LastPass over 2022 data breach impacting 1.6 million users