Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Royal Mail website put users at risk due to major security fail

Close up of a Royal Mail van.

One of the websites belonging to Royal Mail, the British postal service and courier company, featured a major vulnerability that could have been used to steal sensitive user data or drop malware onto victim endpoints

A report from Cybernews,uncovered the flaw and “repeatedly informed” Royal Mail about it. 

The site has been offline for months now, the publication states, suggesting that the company has either addressed the issue or is currently working on it.

Dropping malware and stealing data

The flaw in question is called an open redirect vulnerability, a relatively common flaw among web apps that require user-generated input (like a URL, for example) to redirect them to a different page. The vulnerability stems from failing to properly verify or cleanse the input, leaving room for malicious activity. 

“The vulnerability can be exploited by attackers to trick users into visiting malicious websites or phishing pages by disguising the malicious URL as a legitimate one,” Cybernews researchers explained.

In other words, victims could be redirected to a malicious landing page that tricks them into giving away sensitive information (personally identifiable data, payment information, or similar), or to a page where they could be enticed into downloading malware (thinking they’re downloading legitimate software). Best-case scenario - they’re redirected to a page full of ads and spam content.

Companies that have similar problems should make sure their websites validate all user input, Cybernews added, stating that websites can use URL encoding to prevent anyone from tampering with the URLs. Furthermore, website owners can create a whitelist of trusted URLs and only allow redirects to those URLs for even more customization.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.