NEWS / BLOG PROJECTS SERVICES CONTACT /* Styles copied over from the WordPress site to get things looking similar to how they look on there. Customized to be consistent with other areas of the site. */ .wp-post-content figure, .wp-post-content h1, .wp-post-content h2, .wp-post-content h3, .wp-post-content h4, .wp-post-content h5 { margin-bottom: 1rem; } .wp-post-content a { color: #1C4BD0; font-weight: 600; text-decoration-line: underline; text-underline-offset: 4px; text-decoration-thickness: 2px; text-decoration-color: transparent; transition: filter 200ms linear, text-decoration-color 200ms linear; } @media (prefers-color-scheme: dark) { .wp-post-content a { color: #61A6FC; } } .wp-post-content a:hover { text-decoration-color: currentColor; filter: brightness(1.25); } .wp-post-content figure > a { color: initial; font-weight: initial; text-decoration-line: initial; text-underline-offset: initial; text-decoration-thickness: initial; text-decoration-color: initial; transition: initial; } .wp-post-content figure > a:hover { text-decoration-color: initial; filter: initial; } .wp-post-content ol { list-style-type: decimal; margin-bottom: 1rem; margin-left: 2rem; } .wp-post-content ol > li { margin-top: 0.5rem; } .wp-post-content ul { list-style-type: disc; margin-bottom: 1rem; margin-left: 2rem; } .wp-post-content ul > li { margin-top: 0.5rem; } .wp-post-content .has-large-font-size { font-size: 1.875rem; line-height: 2.25rem; font-weight: 600; } .wp-post-content .has-medium-font-size { font-size: 1.5rem; line-height: 2rem; font-weight: 600; } .wp-post-content .has-small-font-size { font-size: 1.25rem; line-height: 1.75rem; font-weight: 600; } .wp-post-content h5, .wp-post-content h6 { font-size: 1.125rem; line-height: 1.75rem; font-weight: 600; } .wp-post-content tr, .wp-post-content td { border: 1px solid #3B82F6; } .wp-post-content .gist .blob-wrapper table tr, .wp-post-content .gist .blob-wrapper table td { border: initial; } .wp-post-content .has-vivid-red-color { color: #CF2E2E; } .wp-post-content b, strong { font-weight: 600; } .wp-post-content .is-layout-flex { display: flex; flex-wrap: wrap; gap: 1rem; } .wp-post-content .wp-block-columns { margin-bottom: 1rem; } .wp-post-content .wp-block-column figure:last-of-type { margin-bottom: 0; } document.addEventListener("DOMContentLoaded", function() { //Copy & modification of code from base for WordPress post images that won't have the image-viewer-supported class set. This ensures all WordPress post images can be exploded. const imageViewerBackground = document.getElementById("image-viewer-background"); const imageViewer = document.getElementById("image-viewer"); const imageViewerImage = document.getElementById("image-viewer-image"); const images = document.querySelector("article.wp-post-content").getElementsByTagName("img"); for (let i = 1; i < images.length; i++) //Start from 1 to skip the author avatar. { images[i].classList.add("shadow-image"); //In cases where the image is very large, we choose to open in a new tab instead. if (images[i].parentElement.nodeName === "A") { images[i].classList.add("image-link"); continue; } images[i].classList.add("image-viewer-supported"); images[i].addEventListener("click", function() { imageViewerImage.alt = images[i].alt; imageViewerImage.src = images[i].currentSrc; imageViewerBackground.classList.remove("hidden"); imageViewer.classList.replace("hidden", "flex-center"); }); } document.getElementById("copy-link-btn").addEventListener("click", async function() { try { await navigator.clipboard.writeText(window.location); document.getElementById("copy-link-icon").classList.add("hidden"); document.getElementById("copy-link-success-icon").classList.remove("hidden"); document.getElementById("copy-link-text").innerText = "Copied!" } catch (error) { alert(error); } }); if (navigator.share) { const shareBtn = document.getElementById("share-btn"); shareBtn.addEventListener("click", function() { navigator.share( { title: document.title, url: window.location }); }); shareBtn.classList.remove("hidden"); } }); { "@context": "https://schema.org", "@type": "BlogPosting", "author": { "@type": "Person", "name": "Eaton" }, "dateModified": "2026-06-26T15:23:53Z", "datePublished": "2026-06-24T16:11:49Z", "headline": "Exploiting vulnerabilities in Johnson & Johnson web apps" } Exploiting vulnerabilities in Johnson & Johnson web apps Eaton • Jun 24, 2026 Copy Link Share Today I am revealing vulnerabilities I found in 2 very different Johnson & Johnson web apps. One is a vulnerability in a college campus recruiting system that exposed details of nearly 1,000 students, and the other is an admin takeover of an internal audit system used by 20 companies. Let’s dive in!
You know those career fairs and recruiting events on college campuses? JnJ likes to go to these to scout new talent. They built a “Campus Recruiting” website to manage these events:
Nothing particularly exciting… until you look at the underlying code of the website, where you can find some interesting private recruiter routes!
When you go to “/recruiter”, you are sent to the Microsoft SSO login page, confirming this part of the site is restricted to JnJ employees:
The authentication setup is really simple. The Microsoft Authentication Library (MSAL) is integrated into the frontend and it is in charge of making sure an employee is logged in:
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: eaton-works.com.
