In the last year we have seen many government websites using .gov and .mil domains hosting pornographic and spam content, such as Viagra ads.
A security researcher noticed that all of these websites share a common software vendor.
See also: Governments are targeting ads to control behavior
United States of porn
Security researcher Zach Edwards has identified the issue in these .gov and .mil domains and it is the use of a common product provided by Laserfiche.
Laserfiche provides services to the FBI, CIA , U.S. Treasury Department , military, and many other government agencies.
The software product called Laserfiche Forms contains a vulnerability that allowed threat actors to push malicious and unwanted content to trusted government websites.
See also: YouTube Premium Lite: Offers ad-free viewing
Edwards, who has been tracking the flaw for more than a year, has identified that websites for U.S. Senator Jon Tester and the Minnesota National Guard are redirecting users to Viagra product pages.
He shared a video demonstrating the vulnerability in action and says he has seen this behavior "on probably 50 different government subdomains.".
Laiserfiche releases a cleanup tool (not all versions have been patched))
Laserfiche has now released a security advisory about the vulnerability, along with instructions on how to clean the site of unwanted content.
According to the company, the root cause of the issue is an unvalidated file upload vulnerability.
Parts of Laserfiche Forms contain a public form that has a file upload field. This can be accessed by unauthenticated users to upload files to your web portal and make their content temporarily accessible on the web.
See also: Pinterest blocks weight loss ads
Laserfiche has released a cleanup tool that customers can use to clean up unauthorized uploads made to their online portals.
Information source: bleepingcomputer.com
