According to the claims, a threat actor named Hex0rb has apparently discovered a number of vulnerabilities in the FBI's online portal.
This information was shared on a dark web cybercrime forum called BreachForums, which is notorious for attracting cybercriminals. Despite the FBI's efforts to shut it down, the forum quickly resurfaced.
It is possible that the threat actor did not directly disclose the information to the organization, indicating that they may have shared it on a crime forum for others to exploit.
Hex0rb found multiple vulnerabilities, such as Command Injection, Cross-Site Request Forgery (CSRF), Server-Side Template Injection (SSTI), HTTP Parameter Pollution, Clickjacking, Sensitive Data Exposure, HTTP Response Splitting, HTTP Smuggling, Web Cache Deception, HTTP Desync, SSI Injection, and HTTP Method Override.
Here are the following vulnerabilities found:
Hex0rb shared a text file that clearly outlines the strengths and weaknesses of the FBI portal, emphasizing the areas where the portal may be vulnerable to attacks.
As an illustration, the file clearly identified Command Injection and CSRF as vulnerabilities, while stating that Local File Inclusion (LFI) and Remote File Inclusion (RFI) were not.
The hacker also noted that these vulnerabilities were used to acquire an AES-encrypted file from the FBI's portal.
Hex0rb confirmed that they had successfully executed the commands when asked about their actions with these vulnerabilities. This confirmation was revealed when they leaked the AES-encrypted file that they obtained from the FBI portal.
A cybersecurity researcher, who provided their perspective, expressed doubt regarding any attempts to exploit these vulnerabilities.
“Even with the amount of vulnerability there is to it, nobody in their right mind would dare attack the FBI portal website. They do not want to be on the wanted list nor be targeted by one of the most feared organizations in the United States, just for clout.”
Hex0rb has a track record of focusing on prominent organizations. This threat actor has also been known to scrape data from FBI and CIA servers and share encrypted AES files obtained from these agencies.