CHENNAI: India’s cyber security agency has flagged 303 government, state-owned and critical-sector websites as potentially vulnerable to a pair of serious flaws in the PHP programming language, S Krishnan, secretary of the Ministry of Electronics and Information Technology (MeitY), said on Saturday.
Krishnan told this newpaper that the Indian Computer Emergency Response Team (CERT-In) had identified 89 instances belonging to central government bodies and 80 to state and union territory governments. Central public sector undertakings account for 27, state-owned companies for 24 and critical-sector organisations for 83.
They are part of about 60,000 Indian websites CERT-In has identified as vulnerable to the flaws, known as PHP2Shell, he added. The numbers come with a caveat. “These figures represent potentially vulnerable instances identified for further verification and do not constitute confirmed vulnerable installations,” Krishnan said.
“The concerned entities are required to verify the vulnerability status of the identified instances and undertake necessary mitigation measures, wherever applicable.”
CERT-In has observed, and received reports of, active attempts to exploit the vulnerabilities, Krishnan said. It has identified the associated indicators of compromise and is alerting key organisations to the mitigation steps they need to take.
The PHP2Shell flaws allow remote code execution. An attacker who exploits such a flaw can take control of a web server and potentially reach the databases connected to it.
Asked how many sites had been patched and how many remained exposed as of October 23, Krishnan said the figures were “under assessment”.
Asked whether the National Informatics Centre (NIC), the Unique Identification Authority of India and other agencies had completed their reviews, and whether any systems had been compromised, he said NIC had found 14 of its 112 critical systems vulnerable under the PHP advisory. Patching of those systems is complete, he said, though assessment and patching status remain subject to verification by the entities.
No deadline has been set for central and state agencies to complete assessment and patching, he said.
CERT-IN
CERT-In said only that it was advising entities to patch “on an urgent basis without delay”. Asked whether a central mechanism exists to track the remediation, including for applications run by private vendors, S Krishnan, secretary of MeitY said CERT-In monitors the position through “available threat intelligence sources”.