The Global Supplier Preparation Information Management System, or GSPIMS, of Toyota, was breached by a security researcher using a backdoor. After 90 days, the hacker dutifully alerted the company about the breach.
The firm’s web platform, known as GSPIMS, enables employees and suppliers to remotely log in and manage the company’s extensive supply chain. It is an Angular single-page application. Based on a license key embedded in the app for AG Grid, it was created by SHI International Corp – USA on behalf of Toyota.
“I discovered what was essentially a backdoor login mechanism in the Toyota GSPIMS website/application that allowed me to log in as any corporate Toyota user or supplier just by knowing their email”, a security specialist who blogs under the pseudonym EatonWorks.
He eventually found the email address of the system administrator and was able to access their account. He says “I had full control over the entire global system”.
Also, he had complete access to all internal Toyota projects, data, and user accounts, including those of Toyota’s partners and suppliers from outside the company.
On November 3, 2022, Toyota was properly informed of the issues, and by November 23, 2022, the firm had verified they had been resolved.
Specifics of the Toyota’s Breach
The researcher made the decision to investigate any potential threats concealed behind the login screen.
He had to modify the JavaScript code to get beyond the login screen. Here, developers may control who has access to particular pages by utilizing the Angular framework, which will return true or false.
Researcher explains that patching the JavaScript was all that was needed to achieve full access since their API was improperly secured.
In GSPIMS’ case, no data would load from the API. All the endpoints would return HTTP status 401 – Unauthorized responses due to the missing login cookie.
“Toyota/SHI had seemingly secured their API correctly, and at this point, I was about to write this site off as “probably secure”. I don’t bother reporting single-page-application bypasses unless it also exposes a leaky/improperly secured API”, says the researcher.
Further, the analyst rapidly realized that the service was creating a JSON Web Token (JWT) based on the user’s email address for password-less login. Therefore, someone may create a valid JWT if they were able to guess a genuine email address of a Toyota employee.
“I had discovered a way to generate a valid JWT for any Toyota employee or supplier registered in GSPIMS, completely bypassing the various corporate login flows, which probably also enforce two-factor authentication options”, the researcher.
Then the researcher was trying to locate a user who had the System Admin position and came across another API endpoint called findByEmail that only required a valid email to return data on a user’s account. Conveniently, this also identifies the managers of the user.
This gave him access to the User Administration section. He poked around more and found users with even higher access, such as Supplier Admin, Global Admin, and finally, System Admin.
A GSPIMS system administrator has access to private data, including 14,000 user profiles, project schedules, supplier rankings, and classified documents.
Researcher said Toyota prevented what may have been a disastrous leak of information about both their partners’ and suppliers’ employees as well. It was possible to make embarrassing internal remarks and supplier rankings public.
Because cyberattacks on Toyota and its suppliers have previously occurred, another one was quite likely.
Network Security Checklist – Download Free E-Book
