Security Researchers Bypass MFA to Remotely Unlock Vehicles via Exposed Admin Tools

Security researchers successfully demonstrated the ability to remotely unlock and control vehicles from a major automaker by exploiting a chain of vulnerabilities in the manufacturer's connected car infrastructure. By identifying exposed administrative tools and hardcoded credentials, the team was able to bypass multi-factor authentication (MFA) and take over user accounts, effectively gaining control over the vehicles' remote commands.

Discovery of Exposed Infrastructure

The investigation began by decompiling the automaker's mobile application to reconstruct the API requests used for remote car unlocking. This revealed that the application communicated with a specific telematics domain, which hosted several subdomains including an administrative tool.

This image supports the technical description of the API requests used for remote car unlocking discovered during the initial investigation.

One specific subdomain, titled 'TEST HARNESS,' provided a login screen and a rich API that allowed employees to interact with customer accounts and production vehicles. Many of these APIs required no authentication beyond hardcoded keys found directly within the application's JavaScript bundle.

This visual illustrates the type of administrative interface and vehicle data the researchers accessed through the exposed 'TEST HARNESS' subdomain.

Identity Platform Vulnerabilities

The researchers identified that the automaker relied on ForgeRock's OpenIDM software to manage the identities of all connected car users. While the automaker had implemented a Web Application Firewall (WAF) to block access to sensitive OpenIDM endpoints, the underlying assets remained publicly accessible.

The team discovered a 'cursed' vendor JavaScript bundle that contained actual administrative credentials for the OpenIDM production environment. While these credentials were intended for a staging environment, they functioned in production due to a lack of proper environment isolation.

Bypassing Security Controls

To reach the restricted OpenIDM APIs, the researchers used path traversal techniques to circumvent the WAF. Although some routing quirks initially blocked their attempts, the team eventually identified a specific path—`/static%2f..%2fopenidm/`—that was not covered by the WAF rules.

This image provides a visual example of the specific path traversal technique used to reach the restricted OpenIDM APIs.

Once the bypass was successful, the researchers could perform a PATCH request to overwrite the passwords of any user profile. By combining this with a series of token exchanges, they were able to generate a valid mobile app access token, effectively bypassing the multi-factor authentication (MFA) step.

Scope and Limitations

The researchers confirmed these vulnerabilities within the automaker's Australian environment. While the exploit chain provided full remote control over vehicle functions like locking, unlocking, and horn usage, the specific brand of the automaker was not disclosed in the report.

The report highlights a significant trade-off between ease of access and security: the automaker invested heavily in WAF rules to protect the identity platform, but these rules acted as a 'bandaid' over the fundamental issue of exposing the management infrastructure to the public internet.