Default Apache Felix Credentials Let Researchers Take Over Accounts and Control Cars at Two Automakers
Summary
Researchers say default admin credentials and a path-confusion bypass exposed two unnamed automakers’ identity servers, enabling customer account takeovers and remote control of test cars. Both firms fixed the issue about two hours after disclosure.
Key points
- Researchers Sam Curry and Shubham Shah found exposed Apache Felix management consoles on identity servers serving two unnamed automakers.
- A path-confusion technique bypassed the web application firewall, and the console’s default admin credentials enabled access to run code on production servers.
- Using the identity administrator account, researchers could change customer login details and access vehicle information and remote commands.
- In a test, they took over an account and unlocked and started its car with the owner present; they then stopped and locked it.
- The researchers tested the full chain with US accounts and cars; they did not provide the number of affected customers.
- Both automakers fixed the issue and changed the exposed credentials about two hours after being notified. The article says it is unknown whether they checked logs for earlier access.
Article Details
- Attack Vectors
- Researchers used path confusion to bypass a web application firewall and reach the Apache Felix web console on the automakers’ ForgeRock Identity Management servers.
- The exposed console accepted its default username and password, both “admin”.
- Through the console, researchers created a scheduled job that ran their code and provided a command line on production identity servers.
- The server environment contained the IDM administrator’s credentials, which allowed access to customer records and changes to customer email addresses and passwords.
- After changing a test account’s email and password, researchers signed in through the normal app flow and used its remote vehicle commands to locate, unlock, start, stop, and lock the test car.
- Defensive Notes
- Ping’s hardening guidance says to remove the Apache Felix web console or change its default credentials before production use.
- Both automakers fixed the issue and changed the exposed credentials about two hours after the researchers reported it.
- The article says drivers do not need to patch their cars; the flaw was on the automakers’ servers.
- Drivers who do not use remote features can ask their automaker or dealer whether connected services can be switched off.
- The article does not say whether the automakers checked their logs for earlier exploitation.
MITRE ATT&CK
T1053 · Scheduled Task/JobFrom the console, researchers created a scheduled job to run their own code on the production identity servers.T1059 · Command and Scripting InterpreterRunning their code through the scheduled job gave researchers a command line on the production identity servers.T1078 · Valid AccountsThe console accepted its default admin:admin credentials, giving the researchers access to its management functions.T1098 · Account ManipulationUsing the IDM administrator account, researchers changed a test customer’s email address and password, then used the account to access vehicle controls.T1190 · Exploit Public-Facing ApplicationResearchers used path confusion to get past the web application firewall and reach the Apache Felix web console on the automakers’ production identity servers.
People
Vendors
ForgeRockBoth carmakers’ Android apps log customers in through ForgeRock, an identity platform that Thoma Bravo combined with Ping Identity in 2023.Ping IdentityBoth carmakers’ Android apps log customers in through ForgeRock, an identity platform that Thoma Bravo combined with Ping Identity in 2023.
Products
Apache Felix web consolelooked like a harmless static file to the firewall reached something else on the server: the Apache Felix web console, a management page built into IDM.ForgeRock Identity Management (IDM)The apps led the researchers to the part that stores the customer records, ForgeRock Identity Management (IDM).