A security researcher has uncovered over 100 significant vulnerabilities in publicly available UK government code, raising alarms about the potential exposure of sensitive data due to inadequate cybersecurity practices. The findings, reported by Chris Nesbitt-Smith of ControlPlane, highlight systemic issues within government departments that have prioritized transparency and cost-efficiency over robust security measures.
For nearly a decade, the UK government has embraced a policy of openly publishing code developed with public funds, aiming to foster transparency and facilitate code reuse. However, funding constraints have led to a neglect of necessary maintenance and improvements in technology infrastructure. Nesbitt-Smith utilized consumer-grade AI models on a personal laptop to identify these vulnerabilities, suggesting that many could have been detected through standard IT health checks. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he stated, emphasizing the simplicity of the issues found.
Critical Vulnerabilities Identified
Among the most alarming vulnerabilities was a case involving the Planning Inspectorate, which oversees land-use matters in England. The agency inadvertently published sensitive login credentials to a public repository on GitHub, granting extensive access to SharePoint sites and private employee OneDrive accounts, including HR records. This oversight posed a significant risk, as it could have allowed malicious actors to encrypt or steal sensitive data.
A spokesperson for the Planning Inspectorate confirmed that their cyber monitoring tools detected the researcher’s activity in August and that they had already classified the incident as a cyber threat. The agency acted swiftly, resolving the vulnerability within 20 minutes of being notified and verifying that no data breach occurred. “We have reviewed and strengthened our systems and processes to prevent this type of issue recurring,” the spokesperson noted.
Widespread Vulnerabilities Across Departments
Nesbitt-Smith’s analysis revealed vulnerabilities in approximately two-thirds of the 349 public sector codebases he examined across 33 organizations. Notably, several issues were found within the Department of Education’s code, including vulnerabilities in a procurement service used by schools and a teacher application service that contained personal information. Additionally, a vulnerability in the Scottish Government’s open data portal could have allowed unauthorized access to administrative account information.
In light of these findings, there have been discussions about whether public sector departments should cease publishing source code openly, particularly as AI technologies have accelerated the discovery of vulnerabilities. Reports indicate that the NHS has begun transitioning away from open-source code due to security concerns related to AI models.
Implications for Future Cybersecurity Practices
Nesbitt-Smith cautioned that abandoning open-source practices without addressing the underlying security issues could exacerbate the problem. “Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it,” he warned, suggesting that such actions might signal to potential adversaries that vulnerabilities exist within those systems.
The situation underscores the need for improved cybersecurity hygiene within government agencies, particularly as reliance on open-source code continues to grow. As organizations navigate the balance between transparency and security, the findings serve as a critical reminder of the vulnerabilities that can arise from neglecting routine maintenance and oversight.
For further insights into the vulnerabilities identified, see the detailed report by ControlPlane here.
