The British postal service and courier company has left an open redirect vulnerability on one of its sites, exposing its customers to phishing attacks and malware infections.
The centuries-old Royal Mail is the largest courier company in the UK, boasting twice the market share of Amazon.
At the beginning of the year, the company made headlines after it refused to pay LockBit’s $80 million ransom, calling it “absurd.” The ransomware attack by a Russia-linked syndicate crippled Royal Mail, and it temporarily couldn’t dispatch items overseas.
The company might have upped its security game since the incident, however, recent Cybernews research shows that there’s room for improvement.
Our research team found that a site belonging to Royal Mail had an open redirect vulnerability.
An open redirect vulnerability is a security flaw that arises when a web application utilizes user-supplied input, such as a URL or parameter, to direct the user to a different page without appropriately verifying or cleansing the input.
Redirection scheme
“The vulnerability can be exploited by attackers to trick users into visiting malicious websites or phishing pages by disguising the malicious URL as a legitimate one,” Cybernews researchers explained.
We’ve repeatedly informed the company about the flaw, and the site in question has been down for months now, indicating that Royal Mail is working to mitigate the issue or has already done so. The company has yet to respond to our requests for comments.
Significance
Users can be lured into fake websites designed to steal credentials and credit card numbers, among other things.
Open redirect vulnerabilities can be leveraged to download malicious software onto the victims’ devices.
Users might end up on pages filled with spam and other low-quality content.