[BreachExchange] Staples data breach caused by bug in order tracking system

[Destry Winant]

https://www.bleepingcomputer.com/news/security/staples-data-breach-caused-by-bug-in-order-tracking-system/

The reason for the recent notification from Staples to some of its
customers about exposed order details was caused by insufficient
protections for retrieving shopper information from current and past
orders.

Staples said that they found no evidence of unauthorized purchases on
behalf of impacted customers and that they fixed the issue.

Matching order ID and ZIP code

This theory was plausible, especially since threat intelligence
company Bad Packets revealed that Staples kept several Pulse Secure
VPN servers unpatched for CVE-2019-11510 a long time.

BleepingComputer learned that Staples had two endpoints that allowed
customers to track their purchases using the order number and the
postal code (ZIP) and one of them could reveal info on someone else’s
order.

Two factors contributed to this, one being that the order numbers were
sequential, so adding or subtracting a number from them would give a
valid order ID for a purchase from a different customer.

Another factor was that requesting tracking info of a package did not
require a ZIP code, although the field was present.

Starting from a valid order number, a hacker could learn the route of
a package (city, state) and, eventually, the delivery address. This
significantly reduces the effort of finding out the ZIP code for the
final destination.

By combining an order number with the correct delivery ZIP code, a
hacker could call another endpoint to get the full order details of a
customer.

Exposed data

Letting clients track their purchases using just these two details is
common and sufficiently secure, as long as order IDs are not
sequential, because the probability to hit a valid combination is very
low.

In the case of Staples, a correct pairing exposed the following details:

full name
credit card’s last four digits and its type
phone number
full postal address
email address
history of ordered items
other personally identifiable information that could be used to get more data

The same endpoint provided details about current orders, too, which
means that someone could cause some trouble by canceling them or
initiating a return. With the destination address was exposed, the
risk of stealing the goods upon delivery also existed. Furthermore,
this information could enable phishing attacks over both email and
phone.

>From information received by BleepingComputer, not all customers that
ordered from Staples recently received the email about their info
being exposed.

Staples confirmed to BleepingComputer that the issue no longer exists.
We learned that it took the company close to two weeks to solve the
problem from the time they were alerted of the risk.