TLDR Tech / InfoSec
Exploiting vulnerabilities in Johnson & Johnson web apps
Johnson & Johnson's campus recruiting site exposed nearly 1,000 students due to bypassed client-side checks and acceptance of a hardcoded AWS API key. Additionally, the Audit Tracking Management System (ATMS) app exposed user lists, session creation, and admin access via unauthenticated APIs and local-storage spoofing. The ATMS was reportedly fixed only after media intervention, with significant delays.
Read the full story