Researchers from the Sakura Samurai team disclosed a security vulnerability on January 11 that allowed them to gain access to more than 100,000 private files of United Nations Environment Programme (UNEP) employees in less than 24 hours . The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to “clone” Git repositories and collect a large amount of personally identifiable information (PII) related to UN employees.
Having encountered the United Nations Vulnerability Disclosure Program and the InfoSec Hall of Fame, Sakura Samurai researchers Jackson Henry, Nick Sahler, John Jackson, and Aubrey Cottle began looking for any security flaws affecting UN systems . They then discovered exposed Git directories (.git) and Git credentials files (.git-credentials) on domains associated with UNEP and the United Nations International Labour Organization (ILO). The researchers were able to “steal” the contents of these Git files and clone entire repositories from the *.ilo.org and *.unep.org domains using git-dumper .
The .git directory contains “sensitive” files, such as WordPress configuration files (wp-config.php) that expose administrator database credentials. Similarly, different PHP files exposed as part of this data breach contained plain text database credentials associated with other UNEP and ILO web systems. In addition, the publicly accessible .git-credentials files allowed researchers to gain access to the UNEP source code base
The data that the researchers were able to access contains over 100,000 UN employee records. Using these credentials, the researchers were able to retrieve over 100,000 UN employee records from multiple systems.
The dataset obtained by the team exposed the travel history of UN staff, with each row containing: employee ID, names, employee groups, travel justification, start and end dates, approval status, destination, and length of stay. Similarly, other UN databases that the researchers accessed exposed human resource demographics (nationality, gender, salary) of thousands of employees, project funding source records, general employee records, and performance evaluation reports.
Sakura Samurai researchers told BleepingComputer about their endeavor: “When we started investigating the UN, we didn’t think it would evolve so quickly. Within a few hours, we had already obtained sensitive data and identified vulnerabilities. In total, in less than 24 full hours, we obtained all of this data. In total, we found 7 additional credential pairs that could have led to unauthorized access to multiple databases. We decided to stop and report this vulnerability once we were able to access PII that was exposed through database backups located in private projects.”
It is noteworthy that hackers may have also managed to gain access to this data.
Saiful Ridwan, head of enterprise solutions at UNEP, thanked the researchers for reporting the vulnerability, stating that the DevOps team had taken immediate steps to fix the vulnerability and that an impact assessment of this vulnerability is underway. The researchers told BleepingComputer that the United Nations acted immediately to mitigate the vulnerability, noting that the only thing they are currently concerned about is informing the affected individuals. Specifically, Aubrey Cottle AKA Kirtaner noted that if it were that easy to obtain the data, cybercriminals would likely have already managed to obtain it.
This is not the first time that UN systems have suffered a data breach. The organization is a frequent target of cybercriminals. In 2019, hundreds of gigabytes of internal data were stolen, possibly including highly sensitive information on human rights activists – a fact that became known in 2020. The organization appeared to use its diplomatic immunity to keep the incident secret.
This time, however, the UN is believed to have quickly patched the vulnerabilities in question and is securing the exposed data.
