# <![CDATA[Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More]]>

Researchers found SSO, SQLi, IDOR and mass-assignment flaws across BMW, Mercedes, Ferrari, Spireon, Reviver and others, enabling remote vehicle control and account takeover.

- Payout: Research
- Severity: critical
- Program: Automotive industry
- Credited: Sam Curry
- Disclosed: 2023-01-03
- Write-up quality: 9/10
- Original: https://samcurry.net/web-hackers-vs-the-auto-industry
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry
- Tags: domain:api domain:web impact:ato impact:data-leak impact:rce kind:research platform:research sev:critical tech:aws technique:js-analysis technique:source-review vuln:access-control vuln:auth-bypass vuln:idor vuln:info-disclosure vuln:rce vuln:sqli

**Target:** Automotive telematics APIs, employee SSO portals, admin panels
**Root cause:** Multiple: wildcard user enumeration plus TOTP endpoint leaking codes for SSO reset; SQL injection in admin login; regex blacklist bypass via %0d prefix; mass assignment of role/type fields; JS-disclosed API keys and rest-connectors exposing credentials.
**Steps:**
1. BMW: `GET /rest/api/application.wadl` on xpita.bmwgroup.com enumerates endpoints
2. Wildcard `GET /reset/api/users/example*` enumerates usernames/IDs
3. `GET /rest/api/chains/accounts/<id>/totp` returns victim TOTP; use in password reset to ATO
4. Mercedes: register on umas.mercedes-benz.com, reuse creds on git.mercedes-benz.com SSO, reach actuators/Jenkins for RCE
5. Ferrari: read JS constants for apiUrl/apiKey, `GET /cms/dws/back-office/rest-connector-models` leaks auth headers, query `GET /core/api/v1/Users?email=`
6. Spireon: login `victim' #` SQLi as admin; bypass WAF with `GET /%0dadmin`
7. Reviver: mass-assign `type` to 0/4, invite user to inherit elevated role, then query other users
**How found:** Started from scooter app causing horns/lights; hypothesized telematic APIs share patterns. Fingerprinted hosts with gau/ffuf, found WADL, noticed 'totp' endpoint name, guessed forgot-password flow. For Ferrari, read JS constants and rest-connector routes. For Spireon, apostrophe parity test then fuzzed %00-%FF around blacklisted strings.
**Exploitation:** BMW: enumerate user ID, fetch TOTP, complete password reset, log into dealer portal and query VINs. Spireon: SQLi into admin portal to send commands to 15.5M devices, then %0d bypass for direct backend access and fleet takeover. Ferrari: leaked API key and rest-connector auth headers to read/modify any customer and create super-admin.
**Escalation:** Mercedes: limited SSO account escalated to RCE via exposed Spring Boot actuators and Jenkins, plus Mattermost access for social engineering. Reviver: mass-assigned role then re-invited user to inherit permissions, then brute-forced role index 0 for super admin.
**Insight:** When an SSO exposes a TOTP-generation endpoint keyed by user ID and a wildcard user-search, chain them into the forgot-password flow. Also fuzz control characters (%0d) around blacklisted path strings to bypass regex-based WAF authorization.