One of the @IndianPostOffice subdomain, http://digitization.indiapost.gov.in , was vulnerable to an Apache vulnerability aka CVE 2017-5638 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638 …
-
-
Show this thread
-
This vulnerability is a remote code execution. It means an attacker was able to run code on the
@IndiaPostOffice server. In the screenshot you can see the output of the dir command which list the content of the current folderpic.twitter.com/RbyeybFhoc
Show this thread -
This server contain a lot of interesting files: Contract_Data2018-03-05.xls, Customer Advance Balance2018-03-05.xls, CustomerBookings2018-03-05.xls, OfficeSpecificData2018-03-05.xls, Bank Master2018-03-05.xls, ...https://pastebin.com/9vME467h
Show this thread -
I opened EmployeeBankDetails2018-02-23.xls for example. There was a lot of bank accounts inside.pic.twitter.com/vjFhZOhW3j
Show this thread -
For the record, I was not the 1st. Someone created 3 files on 13-04-2017 in order to exploit the vulnerability.pic.twitter.com/lgiIjePnHB
Show this thread -
This issue has been found by an
#Indian security researcher who want to stay anonymous. All credits goes to him.Show this thread
End of conversation
New conversation -
-
-
Did
@IndiaPostOffice replied you? - 1 more reply
New conversation -
-
-
Brilliant thread. So insightful. Hope IndiaPostOffice (and the likes) seek learning from these issues nd invest rightfully in security
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Sir,Bugs noticed in DoP's non production domain https://digitization.indiapost.gov.in are being fixed by our core system integrator. However another layer of security has been added by restricting the access to the intended users only.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
- 1 more reply
New conversation -
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
U and Ur ever ending issues
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.