wordpress blog stats
Connect with us

Hi, what are you looking for?

Security researcher reported vulnerability on India Post server

A French security researcher Robert Baptiste, who goes by the pseudonym Elliot Alderson on Twitter had reported a vulnerability on the India Post server on behalf of an Indian researcher who prefers to remain anonymous. The subdomain digitization.indiapost.gov.in was vulnerable to an Apache vulnerability - CVE 2017-5638, which allows remote code execution on the server. A request crafted to upload a file on a server that processes it with a Jakarta-based plugin. Malicious code in the Content-Type header can then be used to run the command on the server. https://twitter.com/fs0c131y/status/972820110124683264 Elliot Alderson posted several screenshots of the compromised server that showed the directory listing of files, and accessed a file containing Employee bank details. He also found evidence that someone else may have exploited the vulnerability in the past, as files he discovered on the server that were created on 14th April 2017 - almost a year ago. https://twitter.com/fs0c131y/status/972820118244904961 The vulnerability was originally found by an Indian security researcher, who alerted India Post through Alderson. It has now been fixed. Medianama's take Official websites in India are often poorly coded and/or secured. There is an urgent need to ensure the security of government websites and ensure that updates and security measures to address new vulnerabilities are applied promptly. The government also needs to reconsider its response to vulnerability reports. We have often seen instances of those reporting vulnerabilities being persecuted in the past. There are next to no reliable methods of alerting website and app developers as to security risks…

Please subscribe/login to read the full story.
Written By

Vidyut is a commentator on socio-political issues with a keen interest in behavioral sciences, digital rights and security and manages to engage her various proficiencies to bring an unusual perspective to issues related with the intersection of tech and people.

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.

Views

News

Studying the 'community' supporting the late Sushant Singh Rajput (SSR) shows how Twitter was gamed through organized engagement

News

Do we have an enabling system for the National Data Governance Framework Policy (NDGFP) aiming to create a repository of non-personal data?

News

A viewpoint on why the regulation of cryptocurrencies and crypto exchnages under 2019's E-Commerce Rules puts it in a 'grey area'

News

India's IT Rules mandate a GAC to address user 'grievances' , but is re-instatement of content removed by a platform a power it should...

News

There is a need for reconceptualizing personal, non-personal data and the concept of privacy itself for regulators to effectively protect data

You May Also Like

News

Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...

Advert

135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...

News

By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

News

Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ