Identity platform flaw let researchers open two automaker app accounts

Two car brands’ mobile app login systems could be taken over completely after security researchers found a ForgeRock administrator console that still used its default password. The issue let them reach customer records through the identity platform and, in a test on their own and consenting owners’ vehicles in the United States, unlock doors and start an engine.

How the identity servers were exposed

Both brands used ForgeRock, now part of Ping Identity, for sign-in. The platform split its work between a login component and OpenIDM, which stored customer records. OpenIDM included a built-in administrator console powered by Apache Felix, and ForgeRock’s hardening guide already said operators should remove that console or protect it before release because it kept its own password separate from the rest of the system.

On these servers, the console was still present and still set to the documented default password, admin for both the username and the password. The console was blocked from the public internet, but the edge system in front of the site and the Java software behind it interpreted the same web address differently. By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the console path.

From that opening, the rest of the chain became possible. The researchers used the built-in scheduler inside the console to run small scripts that executed their own code on the identity server, which gave them a command prompt on the machine holding customer records for both brands’ logins.

Account control and vehicle access

Once inside, the researchers could reach the records behind the same block. They changed a target account’s email address and password, signed in through the normal app as that customer, and received the same access tokens the real app used. Those tokens allowed account-driven vehicle commands.

Using that access, they unlocked the doors and started the engine of a test car while the owner stood next to it, then stopped the engine and locked it again. They said they reported being able to open a session for any customer account on the affected servers, but they limited vehicle commands to cars they owned or were allowed to use. Their wording was that they had “tested the complete chain only with US accounts and vehicles.”

A second path in Australia

Shubham Shah also published a separate attack on the Australian systems used by the same brands. In that case, the entry point was different: admin credentials for the identity server had been left in the app’s code for a test setup. He described the full Australia chain in a separate post.

Together, the two attacks covered Australia, the United States, and Canada for unlock and engine-start commands. That second post did not give a date for when the Australian systems were fixed. The researchers also said changing the email and password did not log the owner out of the app, and they could route account alerts to their own phone instead of the owner’s.

What was documented and what was fixed

Shubham Shah and Sam Curry published their work late last week. They said both systems were fixed about two hours after they reported the problem, and they put the real email address back after testing. Their write-ups do not say whether anyone else found or used the path before it was closed.

The issue was an implementation mistake in how the brands ran ForgeRock, not a new product bug, so there is no CVE and no vendor advisory to follow. The console and its default password had already been documented for years, and ForgeRock’s production hardening guide had long told operators to remove the console or change its password before going live.

What teams running PingIDM should check

For teams using the same identity software, now sold as PingIDM, the first check is whether the Apache Felix console exists at /system/console. If it does, it should be removed or its default password changed. The other check is whether edge or WAF path rules are being relied on to hide an admin page, since a path that the edge and the server interpret differently can pass those rules.

The two researchers have reported similar work before, usually targeting the web systems behind car apps rather than the vehicles themselves. They have previously shown remote access to vehicles from Honda, Kia, and Subaru, and a Subaru flaw they reported exposed owners’ accounts and cars through that maker’s connected-car service. A broader study in 2023 found the same kind of web weakness across 16 brands.