Researchers use ForgeRock flaws to remotely control cars at two automakers
Original title: Hackers Exploit ForgeRock WAF Bypass and RCE to Remotely Unlock and Start Cars From Two Automakers
Inconsistent URL parsing and default console credentials enabled production RCE; fixes landed about two hours after disclosure.
Security researchers Shubham Shah and Sam Curry found a vulnerability chain in ForgeRock identity servers used by two unnamed automakers. Inconsistent URL handling let them reach an Apache Felix admin console that accepted default credentials, then run code through OpenIDM scheduler scripts. That access yielded customer sessions and remote vehicle functions such as location, unlock, and engine start. Both manufacturers fixed the chain about two hours after disclosure and rotated credentials.
Unconfirmed: The automakers are unnamed, and the article does not confirm criminal exploitation beyond the researchers' tests.
- Both makers used ForgeRock Access Management and OpenIDM with similar infrastructure.
- Researchers reached the Felix console despite WAF blocks on admin paths.
- The console exposed 361 bundles, including 343 active ones.
- Tokens from the mobileappsdkclient OAuth client accessed vehicle data and controls.
- Systems served multiple regions, but only US vehicles were fully tested.
Impact: Remote code execution and remote control of customer vehicles
| Product | Affected |
|---|---|
| ForgeRock OpenIDM | — |
| ForgeRock Access Management | — |
- 1.Remove default credentials from administrative consoles.
- 2.Restrict access to OpenIDM and Apache Felix admin interfaces.
- 3.Enforce consistent URL normalization at the edge and application.
- Vendors
- ForgeRock
From the original article
3 min read at gbhackers.com
Security researchers Shubham Shah and Sam Curry discovered a critical vulnerability chain in ForgeRock identity management servers used by two unnamed automobile manufacturers. The attack let them bypass Web Application Firewall (WAF) protections, achieve Remote Code Execution (RCE) on production servers, and access customer accounts. With this access, researchers could remotely track vehicles, unlock doors, […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.