wordpress blog stats
Connect with us

Hi, what are you looking for?

Security researcher reported vulnerability on India Post server

A French security researcher Robert Baptiste, who goes by the pseudonym Elliot Alderson on Twitter had reported a vulnerability on the India Post server on behalf of an Indian researcher who prefers to remain anonymous.

The subdomain digitization.indiapost.gov.in was vulnerable to an Apache vulnerability – CVE 2017-5638, which allows remote code execution on the server. A request crafted to upload a file on a server that processes it with a Jakarta-based plugin. Malicious code in the Content-Type header can then be used to run the command on the server.

Elliot Alderson posted several screenshots of the compromised server that showed the directory listing of files, and accessed a file containing Employee bank details. He also found evidence that someone else may have exploited the vulnerability in the past, as files he discovered on the server that were created on 14th April 2017 – almost a year ago.

Advertisement. Scroll to continue reading.

The vulnerability was originally found by an Indian security researcher, who alerted India Post through Alderson. It has now been fixed.

Medianama’s take

Official websites in India are often poorly coded and/or secured. There is an urgent need to ensure the security of government websites and ensure that updates and security measures to address new vulnerabilities are applied promptly.

The government also needs to reconsider its response to vulnerability reports. We have often seen instances of those reporting vulnerabilities being persecuted in the past. There are next to no reliable methods of alerting website and app developers as to security risks found. A wariness about being persecuted prevents tech talent in India from testing and reporting vulnerabilities on government servers. In this case, we see the Indian researcher preferring to remain anonymous.

This is not conducive to robust security and the government should urgently set up a mechanism for proper reporting of security threats with prompt action taken about reported vulnerabilities. The Indian government should consider bug bounty programmes that reward talented hackers for finding vulnerabilities and helping secure servers so that more of them are inclined to keep services secure rather than exploit them.

Advertisement. Scroll to continue reading.

There should be a guarantee of protection from prosecution for those reporting security risks at the very least.

You May Also Like

News

The professional social media site LinkedIn leaked 500 million users’ data by leaving it exposed for scrapers, who have now compiled a database with...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ