Exposure of Sensitive Information that Contain Sensitive Markings and PII Information via Search Engine Indexing

Disclosed by
Polyxena
Summary by Polyxena

Summary of the Vulnerability

A critical vulnerability was identified on the globe.gov domain where sensitive documents, including those containing Personally Identifiable Information (PII), were accessible via search engine queries. This issue stemmed from a misconfiguration at the /documents/ endpoint, which was not excluded from search engine indexing.

Documents Exposed:

  1. Applications for the positions of Candidate Mentor Trainer and Trainer that holds Sensitive PII Information:
  2. Documents with sensitivity markings according to NASA VDP Policy NASA POLICY (e.g Confidential, Top Secret, ITAR/ETAR)

Impact

The exposure of sensitive documents poses significant risks including:

  • Privacy Breach: Direct risk of identity theft, financial fraud, and personal harm.
  • Legal and Regulatory Non-Compliance: Potential violation of data protection laws like GDPR or HIPAA.
  • Reputational Damage: Erosion of trust, loss of confidence, and potential partnership or project difficulties.
  • Security Implications: Potential for targeted attacks or further unauthorized access.
  • Operational Disruptions: Diversion of resources, increased operational costs, and need for security overhauls.

Remediation Steps Offered

  1. Immediate Removal of Indexed Content: Utilize tools like Google Search Console to remove exposed documents.
  2. Review and Update Robots.txt: Ensure it disallows indexing of sensitive directories.
  3. Implement Access Controls: Enforce strict access controls at sensitive endpoints.
  4. Audit and Secure Document Storage: Audit and relocate sensitive documents to secure locations.
  5. Regularly Monitor for Data Exposure: Implement monitoring tools to detect unauthorized access attempts.
  6. Enhance Security Awareness and Training: Educate staff on data privacy and secure document handling.
  7. Legal Compliance and Notification: Review incident implications and notify affected individuals as required.
Activity