Default admin:admin Credentials on ForgeRock Identity Servers Let Researchers Take Over Two Automakers' Apps and Start Cars
Two automakers' mobile-app login systems, both built on ForgeRock (now part of Ping Identity), exposed an administrator console that still accepted the default admin:admin credentials, according to researchers Shubham Shah and Sam Curry. Combined with a path-parsing mismatch between the edge filter and the Java backend, that console gave code execution on the identity server, from which the researchers reached customer records, reset a test account and obtained the access tokens that the real app uses to control the car. The full US test was limited to accounts and vehicles the researchers owned or were permitted to use, and both systems were reportedly fixed about two hours after disclosure. No CVE or vendor advisory exists, because the cause is a deployment misconfiguration rather than a product flaw. A separate Australian chain used admin credentials left in an app's code, and the researchers say that together the two chains reached unlock and engine-start commands in Australia, the US and Canada.
Detalhes técnicos
The researchers' own write-up describes OpenIDM as running its Java services as OSGi bundles inside Apache Felix, whose web console conventionally lives at /system/console (samcurry.net). The console was blocked from the internet, but the edge guarding the site and the Java backend interpreted the same web address differently: encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the console (thehackernews.com). The default password then granted access, and the console's built-in scheduler ran small scripts that executed the researchers' code on the identity server (thehackernews.com). From inside the server, they changed a target account's email address and password, signed in through the normal app and received the same access tokens the app uses (thehackernews.com). Those tokens drove the account's own vehicle commands for door unlock and engine start on a test car, and the owner's session was not terminated and alerts could be redirected to another phone (thehackernews.com). The Australian entry point was different: admin credentials for the identity server had been left in the app code, intended for a test setup (thehackernews.com).
Remediação
- Check every ForgeRock or PingIDM deployment for the Felix console at /system/console, and remove it or change its default password, as the maker's hardening guide advises (thehackernews.com).
- Do not rely on edge or WAF path rules to hide admin pages; make the edge and the backend resolve paths the same way (thehackernews.com).
- Rotate administrator and service credentials, and remove any credentials embedded in mobile app code (thehackernews.com).
- Review scheduler jobs and recent changes to customer email addresses, passwords and alert destinations for activity nobody can explain.
- The researchers say the automakers fixed the issue within about two hours and rotated the affected credentials (samcurry.net); the article gives no fix date for the Australian systems (thehackernews.com).
Linha do tempo
-
Default admin:admin Credentials on ForgeRock Identity Servers Let Researchers Take Over Two Automakers' Apps and Start Cars
ler a análise desta fonte ocultar
Two automakers' mobile-app login systems, both built on ForgeRock (now part of Ping Identity), exposed an administrator console that still accepted the default admin:admin credentials, according to researchers Shubham Shah and Sam Curry. Combined with a path-parsing mismatch between the edge filter and the Java backend, that console gave code execution on the identity server, from which the researchers reached customer records, reset a test account and obtained the access tokens that the real app uses to control the car. The full US test was limited to accounts and vehicles the researchers owned or were permitted to use, and both systems were reportedly fixed about two hours after disclosure. No CVE or vendor advisory exists, because the cause is a deployment misconfiguration rather than a product flaw. A separate Australian chain used admin credentials left in an app's code, and the researchers say that together the two chains reached unlock and engine-start commands in Australia, the US and Canada.
Technical Details
The researchers' own write-up describes OpenIDM as running its Java services as OSGi bundles inside Apache Felix, whose web console conventionally lives at /system/console (samcurry.net). The console was blocked from the internet, but the edge guarding the site and the Java backend interpreted the same web address differently: encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the console (thehackernews.com). The default password then granted access, and the console's built-in scheduler ran small scripts that executed the researchers' code on the identity server (thehackernews.com). From inside the server, they changed a target account's email address and password, signed in through the normal app and received the same access tokens the app uses (thehackernews.com). Those tokens drove the account's own vehicle commands for door unlock and engine start on a test car, and the owner's session was not terminated and alerts could be redirected to another phone (thehackernews.com). The Australian entry point was different: admin credentials for the identity server had been left in the app code, intended for a test setup (thehackernews.com).
Remediation
- Check every ForgeRock or PingIDM deployment for the Felix console at /system/console, and remove it or change its default password, as the maker's hardening guide advises (thehackernews.com).
- Do not rely on edge or WAF path rules to hide admin pages; make the edge and the backend resolve paths the same way (thehackernews.com).
- Rotate administrator and service credentials, and remove any credentials embedded in mobile app code (thehackernews.com).
- Review scheduler jobs and recent changes to customer email addresses, passwords and alert destinations for activity nobody can explain.
- The researchers say the automakers fixed the issue within about two hours and rotated the affected credentials (samcurry.net); the article gives no fix date for the Australian systems (thehackernews.com).