How I saved over 200,000 job seekers’ data on staterecruit.in from a potential data breach.

Hello, my name is Biraj Baishya, also known as brutexploiter, and I am a full-time Bug Bounty Hunter and Security Researcher.

Initial Discovery:

The discovery phase of the vulnerability is quite interesting because I visited https://staterecruit.in as a job seeker. As the Government of Assam recently announced Grade III and Grade IV jobs, I visited the site and initiated the job application process. But as a security enthusiast, every time you surf the web, you’ll be curious about how things work.

After submitting the form, I encountered the confirmation page, which seemed okay. However, my first question was: how is the data retrieved from the server? To further investigate, I opened my Developer tools in Firefox (F12) and navigated to the network tab. Since I couldn’t see any API calls, I concluded that the id parameter is responsible for data retrieval from the database.

The first thing that came to my mind after seeing the id parameter is SQL Injection. Since the id parameter is one of the most common targets for SQL Injection attacks, those who aren’t familiar with SQL Injection can learn more from the PortSwigger Web Academy or the OWASP Web Testing Guide.

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can allow an attacker to view data that they are not normally able to retrieve. This might include data that belongs to other users, or any other data that the application can access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

Read more: https://portswigger.net/web-security/sql-injection

Now the testing begins…

When testing for SQL Injection, the first step is to detect the SQL injection vulnerability. Therefore, the first thing I did was enter a single quote character ' and look for errors or other anomalies. Upon entering the single quote character ', the server throws a SQL error in response.

Note: Sometimes the server won’t show any error message in response. In that case, we have to test for a boolean condition or time-based SQL Injection.

The next thing is to find the number of columns and query the database type and version.

For Finding the columns:

ORDER BY 1

ORDER BY 2

ORDER BY 3 and so on

For querying the database:

To automate the process I have used sqlmap.

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

sqlmap: https://github.com/sqlmapproject/sqlmap

sqlmap command:

sqlmap result:

After finding the vulnerability, I immediately created a report and sent it to vdisclose@cert-in.org.in, ditec-asm@gov.in, and incident@nic-cert.nic.in.

Steps to Reproduce:

Observe that the server returns an SQL error.

Payloads:

Business Impact:

Successful exploitation of this vulnerability could result in unauthorized access to sensitive data, modification of database contents, or other actions depending on the permissions associated with the database user.

Personally Identifiable Information (PII) :

Timeline:

Dec 14, 2023: Vulnerability Reported to CERT-In
Dec 15, 2023: Initial Response Received from DITEC, Assam, and CERT-In
Jan 8, 2023: Vulnerability Fixed
April 13, 2023: Publicly Disclosed

Thank you for reading. I hope you enjoyed reading the write-up!

References:

Twitter : https://twitter.com/brutexploiter

Linkedin : https://www.linkedin.com/in/brutexploiter