Toyota's Global Supplier Preparation Information Management System (GSPIMS) was recently breached by a security researcher who responsibly reported the issue to the company. GSPIMS is a web application that allows employees and suppliers to remotely log in and manage the firm's global supply chain. The researcher, who goes by the pseudonym EatonWorks, discovered a backdoor in the system that allowed anyone to access an existing user account as long as they knew their email address. After testing the vulnerability, the researcher found that he could access thousands of confidential documents, internal projects, supplier information, and more. The issues were reported to Toyota on November 3, 2022, and the car maker confirmed that they had been fixed by November 23, 2022. EatonWorks published a detailed writeup about the discoveries after the 90-day disclosure process had passed. Toyota did not compensate the researcher for responsibly disclosing the discovered vulnerabilities. The researcher found that by modifying the JavaScript for certain routes and functions, he could unlock access to the app. He then discovered that the service was generating a JSON Web Token for password-less login based on the user's email address. By Googling Toyota employees or performing OSINT on LinkedIn, the researcher was able to find a regional admin account. From there, he was able to escalate to a system administrator account by exploiting an information disclosure flaw in the system's API. With a system administrator account, the researcher was able to access sensitive information like classified documents, project schedules, supplier rankings, and user data for 14,000 users. A malicious actor could have silently gained access to Toyota's system and then copied data without modifying anything, making it difficult to detect. It is unknown if this has already happened, but there have been no massive Toyota data leaks, so it is assumed that EatonWorks was the first to find the login bypass flaw. This disclosure follows a string of breaches, data leaks, and other vulnerabilities discovered over the past year.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 07 Feb 2023 16:00:04 +0000