VULNpocalypse
Breaches and incidents

North Carolina courts (NCAOC): jury excuse portal exposed SSNs, IDs and medical records by URL number

WBTV found that “by changing the web address by a single number” anyone could reach other people’s jury deferral uploads, including “social security...

Disclosed
Verification
Reported by a reputable outlet, citing the company

What happened

  • WBTV found that “by changing the web address by a single number” anyone could reach other people’s jury deferral uploads, including “social security numbers, driver’s licenses and medical records” and a rape incident report naming a victim; a follow-up said the flaw “exposed hundreds of peoples’ private information.”
  • Root cause per WBTV: an insecure direct object reference; uploaded documents sat on a publicly accessible link with sequential identifiers and no authorization check.
  • No attacker; found by a member of the public (Zach Duda), who said he reported it through the webmaster form and heard nothing.
  • The pages were blocked after WBTV contacted NCAOC, whose spokesperson said “the webform is secure, as is the repository”; as of 28 Sep NCDOJ said NCAOC “hasn’t provided a breach notice” and that such data “generally does fall within requiring a notice.”

Sources