> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Ricoh: an XXE vulnerability in its cloud storage "RICOH Drive" was exploited and 3,798 login IDs leaked

A vulnerability was exploited on September 18 and 3,798 login IDs may have leaked. Stored files were not affected, and the permanent fix was done on October 27.

Disclosed

2023-10-13

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Between 21:46 and 22:01, there was unauthorized access exploiting an XXE (XML External Entity) vulnerability. [1]

  2. It learned of the case at 17:00. [1]

  3. It announced the case. [1] [2]

  4. It updated the number of IDs concerned to 3,798, correcting duplicates that had been counted. [1]

  5. It fixed the application and completed the permanent measure. [1]

Impact

The login IDs of 3,798 customers (3,429 of RICOH Drive and 369 left over from its closed predecessor RICOH SnapChamber) are concerned. 606 of them had an email address set. For 3 of them the registered name, email address and encrypted password also leaked, and for 2 an encrypted password. No stored files leaked. [1] [2]

Timeline

  1. Started 2023-09-18
  2. Detected 2023-10-04
  3. Disclosed 2023-10-13
  4. 25 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address][Passwords][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスによる情報流出に関するお知らせとお詫びRicoh Company, Ltd. · 2023-10-13
  2. [2][News]リコーのクラウドストレージサービス「RICOH Drive」に不正アクセスScanNetSecurity · 2023-10-23 08:05