CVE-2024-40395

CVE-2024-40395

Description:
An Authenticated Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0
allows attackers to view sensitive information, including PII, regardless of access level.

This allows any user to get data of vehicles, drivers, users and other information of all organizations of the vulnerable system using PTC ThingWorx v9.5.0 instead of the normally allowed view of his own organization.

The IDOR is possible by altering the Organization name parameter in the HTTP requests, which will make the corresponding data to show in the HTTP response.

------------------------------------------

Vulnerability Type:
Authenticated Insecure Direct Object Reference (IDOR)

------------------------------------------

Vendor of Product and Version:
PTC ThingWorx - Thingworx Platform version 9.5.0

------------------------------------------

Affected Endpoints:
- POST /Thingworx/Things/PostgreSQLNew/Services/VehicleProfile_NewV5?
- POST /Thingworx/Things/PostgreSQL/Services/Driver_Pages_New_V3?
- POST /Thingworx/Things/UsersThing/Services/GetUsersByOrganizationMultiQ?

------------------------------------------

Impact: Information Disclosure

------------------------------------------

Attack Vectors:
Compromised Credentials.

------------------------------------------

Discoverer:
Abdulazeiz Rashed Aldhanhani
✅ Leaked Exploit Documentation:

https://rawtext.host/raw?44lh4m

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).