2022年5月6日

員工管理的獨角獸Workrise已經解決了一個開放API泄露某些用戶個人信息的問題。它於2014年在德克薩斯州奧斯汀市成立，是為石油和天然氣行業提供按需和專業勞動力的市場。該公司原名為RigUp，現已更名為RigUp。2021年2月，該公司更名為Workrise，以便更好地服務於更廣泛的能源行業，包括太陽能、建築和軍事。Workrise在2021年5月宣布，它獲得了3億美元，估值為29億美元，公司估值為29億美元。據報道，在疫情期間的轉向失敗後，Workrise上個月宣布大規模裁員，影響了公司600名員工中的數百人。現在，一位名為Rzlr的安全研究人員透露，他們發現了一個不安全的Workrise API，允許任何人直接從Workrise服務器上獲取分包商的個人信息，而不需要密碼。通過使用API，我們可以獲得分包商的姓名、電子郵件地址和某些雇傭事實，以及為分包商提供參考的人的姓名和電子郵件地址，如過去的同事和主管。api是應用程序編程接口(application programming interface)的縮寫，它使兩個物品能夠通過互聯網相互連接，比如智能手機應用程序、Peloton自行車或需要與各自服務器通信的門鎖。當處理未經認證的api時，可以通過在web瀏覽器中輸入與分包商審查相對應的四位用戶ID來查詢它們。 Rzlr said that because the user IDs were sequential, anyone could access the information of another subcontractor by simply changing one of the user IDs. This is a common security flaw known as an insecure direct object reference bug, and it allowed anyone to access the information of another subcontractor by changing one of the user IDs by a single digit. Several of the disclosed documents were produced as recently as 2019 and were labelled as “draught” when they were discovered. More than 920 entries containing names and email addresses were discovered by Rzlr in their restricted assessment of 1,000 records, according to the company. In their statement, Rzlr said that the API did not impose a restriction on the quantity of data that could be downloaded, which they cautioned might have posed a danger of scraping. According to a snapshot that was posted, the data could be simply scraped. CEO Xuan Yong and COO Mike Witte were contacted, but did not answer. A short time later, the API was no longer publicly available and had been replaced with a login page that required a password. According to an emailed statement from Eric Murphy, Workrise’s vice president of security, “users are required to keep public profiles by default.” “Should Workrise establish that any active user data that was not meant to be made public has been exposed, Workrise intends to contact such users immediately,” the company said. After discovering the open API on April 22, Rzlr notified various Workrise email accounts — including Murphy’s and the company’s principal security email address — and they were all notified within minutes. When Murphy was questioned why the API had not been protected for two weeks, he responded that the researcher’s emails had been flagged as spam. Working to resolve another API problem that enabled anybody to access users’ referral codes, which could then be used to query the API to retrieve the names, email addresses and phone numbers of users who had recommended others to join the site, as well as the amount of referral money received. When questioned whether the corporation had conducted security audits of its systems, Murphy said that the company had undergone “several” third-party audits but failed to identify the organisation that was reportedly in charge of the exams in question.