A security researcher has found more than 100 serious vulnerabilities in publicly available UK government code, putting sensitive data at risk as a result of poor cyber hygiene.
The UK government has defaulted to openly publishing code it produces with public money for around a decade because it’s transparent, and making it easier for code to be reused is cost-efficient. This includes within the Department of Health and Social Care, and the Home Office, as well as local authorities.
But funding squeezes have left departments neglecting maintenance and improvement of their technology estate. While ControlPlane security researcher Chris Nesbitt-Smith found the vulnerabilities using Claude’s Opus and Sonnet AI models, he says that he used consumer-grade models on a laptop and that many of the issues could have been caught by a routine IT health check. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he tells WIRED. “It’s all daft stuff.”
In the most serious case he identified, the Planning Inspectorate, which handles land-use matters across England, had failed to fully remove a login after it accidentally committed them to public repository GitHub. The fact the credentials gave such wide access—and seemingly didn’t expire—compounded with the agency’s accidental publication of them, “made it particularly dangerous for them.”
The complete Microsoft Entra ID would have given “god-tier” read and write access to all SharePoint sites and private employee OneDrive accounts, according to Nesbitt-Smith, including HR records. It also would have given access to sensitive libraries which safeguard evidence under legal hold for statutory planning inquiries and appeals, according to the security researcher who found it. “The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” Nesbitt-Smith says.
A spokesperson for the Planning Inspectorate told WIRED its cyber monitoring tools immediately detected Nesbitt-Smith’s activity in August and that it had already been handling this as a cyber incident when ControlPlane made contact. The agency identified and fixed this vulnerability within 20 minutes of the report and verified that no data breach occurred. “We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher’s work and for alerting us to it,” they told WIRED.
The Planning Inspectorate issue “isn’t about open source but internal housekeeping when using public tools,” Amanda Brock, chief executive officer of nonprofit industry group OpenUK. “That data was exposed because of a failure not to follow good process,” she adds. “That’s not an open source security issue.”
In around two-thirds of the 349 public sector codebases across 33 organizations Nesbitt-Smith scanned, he said he found vulnerabilities. Several of these were found in the Department of Education’s code, including in a procurement service used by schools, in a teacher application service containing personal details, qualifications, employment history and identity documents, and England’s main register of government-funded training providers and apprenticeships. He also found a vulnerability in a Scottish Government open data portal which would have allowed any visitor to read administrative account information and to change site configuration. The organizations have since dealt with the issues.
Recently, there have been arguments for public sector departments to stop publishing source code in the open, now that AI has accelerated vulnerability discovery. The NHS reportedly ordered technology teams to transition away from open source code in May amid security concerns about the impact of AI models.
Doing this without immediately fixing the underlying issues would be the “worst case scenario,” according to Nesbitt-Smith, as it prevents researchers like him from finding them, and it’s likely that an adversary has already mirrored these repositories and so will maintain access to them. “Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it,” says Nesbitt-Smith, “because you’re like, ‘Here be dragons over this space. Don’t look here though, please.’”