Vulnerabilities in the McDonald’s chatbot recruitment platform McHire exposed the personal information of over 64 million job applicants, security researchers Ian Carroll and Sam Curry discovered.
When accessing the platform, prospective McDonald’s employees chat with a bot created by Paradox.ai, which did not remove the default credentials for a test account and failed to properly secure an API that allowed access to the chat interactions of every applicant.
The McHire platform, Carroll explains, enables restaurant owners to log in to view applications, and forces Single Sign-On (SSO) for McDonald’s. However, a sign-in page for Paradox team members allowed logging into a ‘123456’ user account, with the ‘123456’ password.
“It turned out we had become the administrator of a test restaurant inside the McHire system. We could see all of the employees of the restaurant were simply employees of Paradox.ai, the company behind McHire,” Carroll explains.
From the account, the researchers could view in-progress conversations between applicants and the chatbot, and could also intervene at certain stages during the interview process.
Looking at the API that fetched the candidate information, the researchers noticed that it contained an insecure direct object reference (IDOR) weakness, exposing an ID parameter that appeared to be the order number for the applicant. For the researchers’ application, that ID was 64,185,742.
“We tried decrementing this number, and were immediately faced with PII from another McDonald’s applicant (including ‘unmasked’ contact data),” Carroll notes.
According to Carroll, the API essentially provided access to every candidate’s personal information, including their name, address, phone number, email address, candidacy state, and an auth token to log into the consumer UI as that user, allowing access to their raw chat messages.
Carroll and Curry notified Paradox.ai and McDonald’s of the security issues on June 30. The default credentials were revoked the same day and both flaws were confirmed as resolved by July 1.
“After our outreach reached the appropriate people, the Paradox.ai team engaged with us, emphasized that safeguarding candidate and client data was their top priority, promptly remediated the vulnerability, and committed to further reviews to identify and close any remaining avenues of exploitation,” Carroll notes.
In its own report regarding the incident, Paradox.ai underlined that the incident impacted a single customer, that the researchers accessed the chat interactions of five job applicants, and that no candidate information was shared online.
“Using a legacy password, the researchers logged into a Paradox test account related to a single Paradox client instance. We’ve updated our password security standards since the account was created, but this test account’s password was never updated,” Paradox.ai said.
“Once logged into the test account, the researchers identified an API endpoint vulnerability that allowed them to access information related to chat interactions in the affected client instance. Unfortunately, none of our penetration tests previously identified the issue,” the company explained.
The test account, which had not been logged in since 2019, was not accessed by other third-parties, Paradox.ai said, adding that it contained no Social Security numbers or other sensitive personal information.
“Both the legacy password and the API endpoint vulnerability have been addressed,” the company said.
*Updated the title as no information was leaked online.
*Updated with information from Paradox.ai.
Related: Subaru Starlink Vulnerability Exposed Cars to Remote Hacking
Related: Millions of Kia Cars Were Vulnerable to Remote Hacking
Related: Points.com Vulnerabilities Allowed Customer Data Theft, Rewards Program Hacking
