A security researcher has identified more than 100 serious vulnerabilities in publicly available code used by UK government departments. The findings highlight significant gaps in cyber hygiene across various public sector organizations, putting sensitive data at risk. The vulnerabilities stem from a decade-long practice of open-sourcing code developed with public funds, a policy intended to promote transparency and cost efficiency.
Planning Inspectorate Credentials Exposed
The most critical issue involved the Planning Inspectorate, the agency responsible for land-use matters in England. The organization accidentally committed login credentials to a public GitHub repository. These credentials provided extensive access to Microsoft Entra ID, granting read and write permissions to all SharePoint sites and private employee OneDrive accounts. This access included human resources records and sensitive legal evidence libraries.
Chris Nesbitt-Smith, a security researcher at ControlPlane, discovered the flaw using AI models. He noted that the credentials did not appear to expire, creating a persistent risk. The Planning Inspectorate stated that its monitoring tools detected the researcher’s activity in August. The agency fixed the vulnerability within 20 minutes of being contacted and confirmed that no data breach occurred.
A spokesperson for the Planning Inspectorate said the agency has reviewed its systems to prevent similar issues. They expressed gratitude for the researcher’s alert, noting that the incident was handled as a cyber incident from the start.
Widespread Vulnerabilities in Public Sector Code
Nesbitt-Smith scanned 349 public sector codebases across 33 organizations. He found vulnerabilities in approximately two-thirds of these repositories. The Department of Education was among the affected bodies. Issues were found in a procurement service used by schools, a teacher application service containing personal details and identity documents, and a register of government-funded training providers.
Additional flaws were identified in a Scottish Government open data portal. These vulnerabilities would have allowed any visitor to read administrative account information and change site configuration. All identified organizations have since addressed the issues.
Amanda Brock, chief executive of OpenUK, argued that the Planning Inspectorate incident was not a failure of open source software itself. She described it as a failure of internal process and housekeeping. The data exposure resulted from poor maintenance rather than inherent flaws in the code licensing model.
Debate Over Open Source Security
The findings have reignited debate about the safety of open source code in the public sector. Some argue that the rise of AI has accelerated the discovery of vulnerabilities, making open repositories more dangerous. The NHS reportedly ordered technology teams to move away from open source code in May due to security concerns.
Nesbitt-Smith warned that hiding code without fixing underlying problems is the worst possible outcome. He explained that adversaries likely already have mirrored copies of these repositories. Closing the code without remediation would only draw more attention to the vulnerabilities. He stated that unless organizations fix all problems, closing the code serves only to highlight the risks.
The researcher emphasized that the sophistication of these attacks is low. He noted that many issues could have been caught by routine IT health checks. The problems are described as basic maintenance failures rather than advanced cyber threats.
Source: Wired
