NetSuite Data Breach Alert: Customer Info Vulnerable on Numerous Sites

TLDR:

• Thousands of Oracle NetSuite e-commerce sites are vulnerable to leaking sensitive customer information due to misconfigured access controls on custom record types.
• It’s recommended that site administrators tighten access controls, set sensitive fields to “None” for public access, and consider taking impacted sites offline temporarily to prevent data exposure.

Cybersecurity researchers have uncovered a significant vulnerability affecting thousands of externally-facing Oracle NetSuite e-commerce sites. The issue lies in the misconfigured access controls on custom record types (CRTs) within the SuiteCommerce platform, potentially allowing attackers to access sensitive customer information. While this is not a security weakness in the NetSuite product itself, it highlights the importance of proper customer configuration to prevent data leakage.

The information at risk includes full addresses and mobile phone numbers of registered customers on these e-commerce sites. The attack scenario involves exploiting CRTs with “No Permission Required” access type, granting unauthenticated users access to data through NetSuite’s record and search APIs. To mitigate this risk, it is crucial for site administrators to tighten access controls on CRTs and set sensitive fields to “None” for public access. Furthermore, temporarily taking impacted sites offline may be necessary to prevent any further exposure of confidential data.

In a related development, security researchers have detailed a method to manipulate the credential validation process in Microsoft Entra ID, allowing attackers to circumvent authentication in hybrid identity infrastructures. This attack relies on exploiting pass-through authentication (PTA) agents in a way that grants unauthorized access within the Azure tenant, potentially leading to privilege escalation.

Overall, these vulnerabilities underscore the critical need for organizations to continuously assess and improve their security posture to protect sensitive customer information and prevent unauthorized access to their systems.