Millions of COVID-19 test reports were found to be publicly accessible due to flawed online system implementation.

The leak, comprising over 8 million COVID-19 test results, has been attributed to the Health and Welfare Department of West Bengal, India.

Researcher spots millions of COVID test results leaking online

Last month, BleepingComputer exclusively reported that multiple Indian government websites were leaking COVID-19 patient test reports.

This week, security researcher Sourajeet Majumder has shared with BleepingComputer his discovery of another government website exposing millions of COVID-19 test results.

“I have found an issue in an Indian Government site which is resulting in the leakage of test reports of EVERYONE who took a COVID-19 test in a particular state.”

“These reports have sensitive information about the citizens in them like name, age, date and time of sample testing, residence address, etc,” Majumder told BleepingComputer.

The state the researcher refers to is the Indian state of West Bengal.

At the time of his original discovery, the researcher suspected the number of publicly accessible reports was crossing the 8 million mark, based on the daily bulletin published by the government.

Majumder spotted the leakage on seeing the contents of a text message sent to a COVID-19 test taker.

The structure of the URL in the text leading to the result comprised a base64-encoded report’s ID number (“SRF ID”) as shown below.

As confirmed by BleepingComputer, the base64-encoded report number could be decoded to a simpler numeric form, incremented/decremented to construct new sets of URLs that would enable accessing other patients’ COVID-19 test results.

Majumder noticed that the base64 encoding applied to the numeric identifier was optional, and stripping it away had no impact on the ability to retrieve the reports. 

In this manner, the researcher demonstrated to BleepingComputer that an attacker could retrieve COVID-19 test results of millions of patients by simply enumerating the URLs:

https://cpms.wbhealth.gov[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX1
https://cpms.wbhealth.gov[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX2
https://cpms.wbhealth.gov[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX3

Every report revealed the patient’s name, age, gender, partial home address, COVID-19 test result, date of the test, report identifier, and details pertaining to the location of the testing lab.

Health department fixes the leak

On seeing the leaky endpoint was hosted on wbhealth.gov.in domain, BleepingComputer reached out to the relevant IT contacts at West Bengal’s Health and Welfare department.

Additionally, the researcher had told BleepingComputer that he had attempted to make contact with the relevant parties beforehand.

Although BleepingComputer did not hear back from the contacted personnel, the issue has been remediated.

The URL endpoints previously leaking the COVID-19 reports now return a 404 (not found) message, as seen by BleepingComputer.

Dr. Sushant Roy, a government-appointed health official tasked with overseeing the COVID-19 situation in North Bengal has also acknowledged the leak.

In a statement made to a regional news outlet, Dr. Roy said that information such as the COVID-19 test result data is meant to be kept confidential especially to safeguard the privacy of COVID-19 patients. He continued that the government only provides such information to the patient’s family members.

Dr. Roy expressed surprise at the system flaw that made it possible to access anyone’s test report and stated that immediate action will be taken to rectify the problem.

This is not the first time COVID-19 test results have been spotted leaking online at such a scale.

Previously, multiple independent labs were leaking patient test results due to a flawed QR code implementation that could let threat actors enumerate the test result URLs.

When generating publicly accessible URLs, it is probably a good idea to include some unguessable or randomized bits of data to them so as to make enumeration challenging.