UK Government Code Vulnerabilities Raise Alarms Over Exposed Data

A security researcher has identified more than 100 serious vulnerabilities in publicly accessible UK government code, putting sensitive information at risk because of inadequate cyber hygiene.

Over the past decade, UK government bodies have largely published code developed with public funds openly. The practice was intended to support transparency and enable reuse while reducing costs. It has spanned departments including the Department of Health and Social Care and the Home Office, as well as local authorities.

However, funding pressures have reportedly left departments struggling to maintain and improve their technology. ControlPlane security researcher Chris Nesbitt-Smith discovered the vulnerabilities using AI coding models, including Anthropic’s Claude Opus and Sonnet, but said consumer-grade models on a laptop were sufficient. He noted that many issues might have been detected through routine IT health checks.

“The level of sophistication that general media worries about in terms of cyber attacks is not present here,” Nesbitt-Smith told WIRED. “It’s all daft stuff.”

In the most serious case, the Planning Inspectorate, which handles land-use matters across England, failed to fully remove a login credential after accidentally committing it to a public GitHub repository. Because the credential provided broad access and apparently did not expire, the exposure was especially severe.

The full Microsoft Entra ID could have granted “god-tier” read and write access to SharePoint sites and private employee OneDrive accounts, including HR records. It could also have exposed sensitive libraries used to safeguard evidence during legal holds for statutory planning inquiries and appeals, according to Nesbitt-Smith. “The option for ransoming them, encrypting all the data, or simply stealing all the data was abundantly there,” he said.

A Planning Inspectorate spokesperson told WIRED that its cyber monitoring tools detected Nesbitt-Smith’s activity in August and that it was already handling the matter as a cyber incident when ControlPlane made contact. The agency said it fixed the vulnerability within 20 minutes of the report and verified that no data breach occurred. “We have reviewed and strengthened our systems and processes to prevent this type of issue recurring, and we are grateful for the researcher’s work and for alerting us to it,” the spokesperson said.

The Planning Inspectorate issue “isn’t about open source but internal housekeeping when using public tools,” said Amanda Brock, chief executive of the nonprofit industry group OpenUK. “That data was exposed because of a failure not to follow good process,” she added. “That’s not an open source security issue.”

Among roughly two-thirds of the 349 public sector codebases across 33 organizations scanned by Nesbitt-Smith, he said he found vulnerabilities. Several were identified in Department of Education code, including a procurement service used by schools, a teacher application service containing personal details, qualifications, employment history and identity documents, and England’s main register of government-funded training providers and apprenticeships. He also found a vulnerability in a Scottish Government open data portal that could have allowed any visitor to read administrative account information or change site configuration. The organizations have since addressed the issues.

Recently, arguments have emerged for public sector departments to stop publishing source code openly, now that AI has accelerated vulnerability discovery. The NHS reportedly instructed technology teams to move away from open source code in May amid security concerns about the impact of AI models.

Doing so without immediately fixing underlying issues would be the “worst case scenario,” according to Nesbitt-Smith, as it would prevent researchers like him from finding vulnerabilities. He said it is likely that an adversary has already mirrored the repositories and may maintain access. “Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it,” he said. “Because you’re like, ‘Here be dragons over this space. Don’t look here though, please.’”

Source link