Full Report
McHire is a chatbot recruitment platform used by most of McDonald's franchisees. Employees chat with a bot named Olivia to collect information, conduct personality tests and more that is owned by Paradox. While going through the interview process, they got some disturbing pro-company questions but didn't see anything interesting. Of note, it seemed like Olivia had a solid set of predefined inputs and wouldn't use anything else. On the signin page, they noticed a small icon for Paradox Team Members. They tried the username and password combination of 123456-123456 and this logged them in as an admin on a test restaurant. Crazy but no real impact. Doing authorization without authentication is super error-prone; think of how people can check in for a flight on an airline without ever creating an account, as an example. Sam and Ian attempted to apply for a job when they noticed the API PUT /api/lead/cem-xhr that fetched data. This was likely proxying information to a Candidate Experience Manager (CEM) via an XHR request. This contained a lead_id parameter. They simply tried decrementing the ID and got another applicant's data. This contained previous chat conversations, names, emails, addresses, and phone numbers. etc. Probably the craziest of all, an Auth token for the consumer UI was also sent back, allowing you to effectively become the user. With no bug bounty contact they reached out to people at Paradox.ai and they prompted remediated the vulnerabilty. Sam does a lot of great research on things without bug bounty programs. Although security is getting better in some places, it's clearly getting worse in others.
Analysis Summary
# Vulnerability: Insecure Direct Object Reference (IDOR) and Default Credentials in McHire Platform Leading to Mass PII Exposure
## CVE Details
- CVE ID: N/A (Not yet assigned based on context)
- CVSS Score: N/A (Likely High/Critical due to PII exposure of 64M records, depending on final scoring)
- CWE: CWE-284 (Improper Access Control), CWE-592 (Authentication weakness)
## Affected Systems
- Products: McHire chatbot recruitment platform (Owned by Paradox.ai)
- Versions: Unknown. Affects configurations using the exposed login and API endpoints prior to remediation.
- Configurations: Any McHire administration interface instances where default credentials were not changed, and the API endpoint `/api/lead/cem-xhr` was improperly protected against sequential ID manipulation.
## Vulnerability Description
Two distinct but related security flaws were identified in the McHire platform:
1. **Default Administrative Credentials:** The sign-in page for Paradox Team Members at `https://www.mchire.com/signin` accepted the default credentials `123456:123456`, granting access as an administrator for a test restaurant.
2. **Insecure Direct Object Reference (IDOR):** The API endpoint `PUT /api/lead/cem-xhr`, used by restaurant staff to fetch candidate details, accepted a `lead_id` parameter. This parameter could be sequenced (e.g., by decrementing the ID) to retrieve data belonging to *any* candidate in the system, regardless of user authorization.
Successful exploitation of the IDOR vulnerability allowed access to sensitive Personally Identifiable Information (PII) for over 64 million applicants, along with internal administration tokens for the consumer UI.
## Exploitation
- Status: Reported and remediated after discovery. Not explicitly stated as exploited in the wild prior to researcher discovery, but the mechanism was successfully demonstrated by the researchers.
- Complexity: Low (Default credentials were trivial; IDOR exploitation required only minimal API interaction knowledge).
- Attack Vector: Network
## Impact
- Confidentiality: **High**. Exposure of names, emails, phone numbers, addresses, chat transcripts, and user authentication tokens for potentially 64 million applicants.
- Integrity: **Medium**. Ability to view state changes and potentially manipulate application flow (though the primary confirmed impact was leakage).
- Availability: **Low**. No direct impact on service availability was noted.
## Remediation
### Patches
- The article confirms that Paradox.ai **promptly remediated the vulnerability** following disclosure. Specific patch versions are not listed, but remediation actions began on 06/30/2025.
### Workarounds
- **Immediate Action:** The researchers noted that by 06/30/2025 7:31 PM ET, the default credentials (`123456:123456`) were no longer usable to access the app.
- **General Mitigation:** Review and enforcement of strong, non-default credentials for all administrative accounts. Implement robust authorization checks on all ID-based API parameters to ensure the requesting user is authorized for the requested resource.
## Detection
- **Indicators of Compromise (IoCs):** Unexpected high volumes of requests to the `/api/lead/cem-xhr` endpoint referencing non-sequential or rapidly incrementing/decrementing `lead_id` parameters originating from administrative accounts.
- **Detection Methods and Tools:** API request logging and anomaly detection systems should monitor for suspicious sequences or mass data retrieval via known resource access endpoints.
## References
- Article: Would you like an IDOR with that? Leaking 64 million McDonald’s job applications (Link provided in context, defanged for summary: hxxps://example.com/McHire_IDOR_leak)