Polish Researchers Find 250,000 Vulnerable Public Websites

At Def Con on Friday, security researchers Robert Kruczek and Kamil Szczurowski presented a sweeping audit of Poland's public web infrastructure. Their findings: over 10,000 public entities and 250,000 websites harbored security flaws, with critical vulnerabilities in a widely-used content management system and a bug affecting roughly two-thirds of the country's judiciary.

The researchers, motivated by patriotism and a desire to improve national security, scanned the Polish web and found that common points of failure—like unmaintained software and a lack of bug bounty programs—left courts, hospitals, and airports exposed to potential hijacks.

Critical Flaws in Pad CMS

One of the most alarming discoveries was in Pad CMS, a content management system used by hundreds of public websites. Kruczek and Szczurowski found a critical vulnerability that allowed them to access over 300 public websites without any password. The software vendor had marked Pad CMS as "end of life" and stopped patching it, leaving the flaws unaddressed.

The researchers demonstrated the exploit, showing how easily an attacker could bypass authentication and take control of these sites. This is particularly concerning because many government agencies rely on such CMS platforms to publish critical information.

Judicial System Breach

Another bug allowed the researchers to gain access to the websites of about 245 courts—roughly two-thirds of Poland's judiciary. The specific technical details of this vulnerability were not fully disclosed, but the impact is clear: sensitive judicial information and communication channels could be compromised.

Systemic Issues: Lack of Bug Bounties and Vendor Negligence

Kruczek and Szczurowski highlighted that many vendors did not have bug bounty programs or clear channels for reporting security flaws. When they reported vulnerabilities, some vendors dismissed them as "inconveniences" rather than serious threats. This lack of cooperation makes it difficult to secure the public web.

The researchers also noted that some bugs were incredibly easy to exploit, yet were not taken seriously. This points to a broader cultural problem where security is an afterthought, not a priority.

Context: Poland's Cyber Defense Efforts

This research comes at a critical time for Poland. The country has been strengthening its cyber defenses after a wave of suspected Russian hacks targeting energy and water providers. Many of these attacks exploited weak cybersecurity, making the findings especially urgent.

Government Response and Next Steps

Kruczek and Szczurowski reported their findings to the Polish government through official channels. While they did not detail the government's response, they expressed hope that their work has made Poland "a little bit more safe."

For developers and security professionals, this research underscores the importance of proactive security auditing and the need for vendors to support their products beyond end-of-life dates.

Technical Takeaways for Developers

  1. Patch Management is Critical: The Pad CMS vulnerability is a stark reminder that unsupported software poses a significant risk. If you're using a CMS or any software that's no longer maintained, migrate or implement compensating controls immediately.

  2. Report Vulnerabilities Responsibly: The researchers faced vendor dismissiveness. If you discover a flaw, document it thoroughly and escalate to appropriate authorities if the vendor is unresponsive.

  3. Advocate for Bug Bounties: Public sector organizations should push for bug bounty programs to encourage responsible disclosure and improve overall security.

Conclusion: A Call to Action

The researchers' work is a wake-up call for public sector organizations worldwide. Governments must invest in security audits, support open-source maintenance, and establish clear reporting channels. For developers, the lesson is clear: never assume your software is secure, and always plan for end-of-life transitions.

As Poland continues to face cyber threats, the importance of this research cannot be overstated. It's a prime example of how security researchers can make a tangible difference in national security.