# IDRBT Domain Registrar Portal — Security Vulnerability Disclosure

**Target:** https://registrar.idrbt.ac.in/
**Researcher:** Cashless Consumer
**Disclosed:** 2026-06-08 via CERT-In
**Impact:** 5,576 unique banking personnel credentials exposed, ₹4.72 Cr financial records leaked

---

## Contents

| File | Description |
|------|-------------|
| `idrbt-poc-final.mp4` | Video PoC — terminal recording with TTS commentary and subtitles |
| `idrbt-demo-2.sh` | Automatic terminal demo script (run: `bash idrbt-demo-2.sh \\| tee log.txt`) |
| `collect-evidence.sh` | Full data extraction script — hits all endpoints, saves structured output (run: `bash collect-evidence.sh`) |

## Vulnerability Summary

The IDRBT Domain Registration Portal exposes **33+ REST API endpoints** without authentication. Any internet user can download the complete user database, invoice records, system configuration, and internal portal content.

### Critical — Data Exposure

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/user/all` | 5,462 | Emails, phones, bcrypt password hashes, OTPs, IPs, device fingerprints, roles, 2FA status |
| `GET /api/dr/user/orphan-users` | 1,074 | Same fields — 99.8% Super Admin role (registration bug) |
| `GET /api/dr/user/deleted-users` | 219 | Same fields — records never actually purged |
| `GET /api/dr/user/get/{email}` | per-user | Full record for any email — no auth |
| `GET /api/dr/invoice/getByOrgId/{id}` | 1,535 | ₹4.72 crore billing history, bank names, domain names, payment status, officer contacts |
| `GET /api/dr/billingHistory/all` | variable | Billing records by user ID |

### High — Information Gathering

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/user/verify-user/{email}` | — | Confirms if email exists in system (5 enumeration endpoints) |
| `GET /api/dr/user/getCheck/{email}` | — | User existence check |
| `GET /api/dr/rgtrUser/verify-user/{email}` | — | Registrar user existence |
| `POST /api/dr/user/get-otp` | — | Distinct error message confirms registered users |

### Medium — Infrastructure / Config

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/static/getAll` | 16 config | GST/TDS rates, domain pricing, rebate, email regex, orphan duration |
| `GET /api/dr/departments/all` | 3 depts | Contractor emails (ikcon), IDRBT staff emails |
| `GET /api/departments/{id}` | per-id | Individual department details |
| `GET /api/dr/rgtrUser/getAlltext` | 6 entries | Portal content for Dev/UAT/Prod environments |
| `GET /api/dr/links/all` | 4 links | Portal navigation links |
| `GET /api/dsc/getTokenRequest` | session | DSC/eMudhra session initiation — encrypted but publicly reachable |
| `GET /api/dsc/getCertificateRequest` | payload | eMudhra certificate request proxy (requires token name) |

### Low — Metadata

| Endpoint | Records | Data Exposed |
|----------|:-------:|--------------|
| `GET /api/dr/dnssec/algorithmTypes` | 8 types | Supported DNSSEC algorithms |
| `GET /api/dr/dnssec/digestTypes` | 4 types | Supported DNSSEC digest types |
| `GET /api/dr/user/activeUser` | 1 | Active user count |
| `GET /api/dr/notification/count/{userId}` | count | Notification count |
| `GET /api/dr/notification/all/{userId}` | list | Notification list |
| `GET /api/actuator/health` | status | Spring Boot health — confirms tech stack |
| `GET /api/actuator` | links | Actuator endpoint discovery |

## Total: 33+ Unauthenticated Endpoints

## Attack Scenarios

1. **Offline password cracking** — 5,576 bcrypt hashes at 10 rounds → portal access → domain hijacking
2. **Pretext phishing** — "Regarding invoice #29981 for sbi.bank.in renewal..." with bank name, domain, amount, officer name
3. **Credential stuffing** — reused passwords across bank internal systems
4. **Supply chain** — contractor emails (ikcon) for social engineering
5. **User enumeration** — 5 separate endpoints confirm if any email exists in the system

## Systemic Issues

- UAT configuration deployed on production domain (`envName: "UAT"`)
- JWT authentication is cosmetic — frontend sends `Authorization: Bearer` header but backend never validates it
- No mandatory DNSSEC/DMARC/HSTS for .bank.in domains
- No vulnerability disclosure program, no security.txt
- No public tender for vendor (IKCON Technologies)

## Remediation (P0)

1. Block ALL `/api/*` public access at nginx reverse-proxy level immediately
2. Force password reset for all 5,576 affected users
3. Audit nginx access logs for data exfiltration
4. Add server-side JWT validation to ALL endpoints
5. Fix orphan user role assignment bug (Super Admin default)

---

*All testing performed using read-only GET requests. No data was modified or exfiltrated beyond documentation. This disclosure is made in good faith to protect affected banking personnel and financial institutions.*
