Security Researcher Finds Over 100 Vulnerabilities in UK Government Code

A security researcher found more than 100 serious vulnerabilities in publicly available UK government code, putting sensitive data at risk. Chris Nesbitt-Smith of ControlPlane said many issues could have been caught by a routine IT health check, and that he used consumer-grade AI models to help find them. The organizations involved have since dealt with the issues.

What the researcher found

The UK government has openly published code produced with public money for around a decade, including code from the Department of Health and Social Care, the Home Office and local authorities. Funding squeezes have left departments neglecting maintenance and improvement of their technology estate. In around two-thirds of 349 public sector codebases across 33 organizations that Nesbitt-Smith scanned, he said he found vulnerabilities.

Several were in Department of Education code, including a procurement service used by schools, a teacher application service containing personal details, qualifications, employment history and identity documents, and England's main register of government-funded training providers and apprenticeships. A Scottish Government open data portal vulnerability would have allowed any visitor to read administrative account information and change site configuration.

Planning Inspectorate credentials

The most serious case involved the Planning Inspectorate, which handles land-use matters across England. It had failed to fully remove a login after it accidentally committed them to public repository GitHub. The credentials gave wide access and seemingly did not expire, and their accidental publication made the issue particularly dangerous.

The complete Microsoft Entra ID would have given “god-tier” read and write access to all SharePoint sites and private employee OneDrive accounts, including HR records. It also would have given access to sensitive libraries which safeguard evidence under legal hold for statutory planning inquiries and appeals. Nesbitt-Smith said the option for ransomwaring the data, encrypting all the data, or just stealing all the data, was abundantly there.

A Planning Inspectorate spokesperson said its cyber monitoring tools immediately detected Nesbitt-Smith's activity in August and that it had already been handling this as a cyber incident when ControlPlane made contact. The agency identified and fixed the vulnerability within 20 minutes of the report and verified that no data breach occurred. It said it had reviewed and strengthened its systems and processes.

Open source and AI debate

Amanda Brock, chief executive officer of OpenUK, said the Planning Inspectorate issue was not about open source but internal housekeeping when using public tools. She said the data was exposed because of a failure not to follow good process, and that it was not an open source security issue.

There have recently been arguments for public sector departments to stop publishing source code openly now that AI has accelerated vulnerability discovery. The NHS reportedly ordered technology teams to transition away from open source code in May amid security concerns about the impact of AI models. Nesbitt-Smith said doing this without immediately fixing the underlying issues would be the worst case scenario, because it prevents researchers from finding them and an adversary may have already mirrored the repositories. He said closing code without fixing problems could draw more attention to it.

Sources: Wired