Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A security researchers' writeup describes chaining a ForgeRock path-confusion bypass of an edge WAF with default Felix console credentials to reach OpenIDM's OSGi bundle inventory on two automakers' login servers.