A security review by Claroc Research found that 35,578 of the 37,571 live apps on SpaceXSI’s Grok Build platform were accessible without authentication, or approximately 94.7%. The main cause was the link-sharing feature, which assigns each app a random identifier on the grok.me domain. Twenty-four of the exposed apps had been created by SpaceXSI and its employees and contained confidential internal materials, including sales territory maps and onboarding documents intended for a US federal agency. Claroc also found data linked to 30 organizations, including 26 with more than 1,000 employees and six Fortune 500 companies, as well as patient records, hospital staff rosters and timesheets containing plaintext passwords. SpaceXSI removed its own 24 apps but had not addressed the exposure of thousands of customer apps when the report was published.
Source: Read the original article
