Pierluigi Paganini
November 08, 2023
The centuries-old Royal Mail is the largest courier company in the UK, boasting twice the market share of Amazon.
The centuries-old Royal Mail is the largest courier company in the UK, boasting twice the market share of Amazon.
At the beginning of the year, the company made headlines after it refused to pay LockBit’s $80 million ransom, calling it “absurd.” The ransomware attack by a Russia-linked syndicate crippled Royal Mail, and it temporarily couldn’t dispatch items overseas.
The company might have upped its security game since the incident, however, recent Cybernews research shows that there’s room for improvement.
Our research team found that a site belonging to Royal Mail had an open redirect vulnerability.
An open redirect vulnerability is a security flaw that arises when a web application utilizes user-supplied input, such as a URL or parameter, to direct the user to a different page without appropriately verifying or cleansing the input.
“The vulnerability can be exploited by attackers to trick users into visiting malicious websites or phishing pages by disguising the malicious URL as a legitimate one,” Cybernews researchers explained.
We’ve repeatedly informed the company about the flaw, and the site in question has been down for months now, indicating that Royal Mail is working to mitigate the issue or has already done so. The company has yet to respond to our requests for comments.
If you want to know more about mitigation take a look at the original post at:
https://cybernews.com/security/royal-mail-open-redirect-flaw/
About the author: Jurgita Lapienytė, Chief Editor @CyberNews
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ObjCShellz)
