In February 2021, the ethical hacking group Sakura Samurai announced that it had breached systems across the Indian government while testing under the government's Responsible Vulnerability Disclosure Program. Its 34-page report listed 35 exposed credential pairs for servers and applications, five exposed private keys, sensitive police reports, more than 13,000 personal records, remote code execution on a state financial server and session hijacking of a government application. Almost all of it started with configuration files and code repositories that web servers served to anyone: exposed .git directories held hard-coded credentials, and exposed .env files listed passwords for databases, email and SMS services. After slow early responses, India's cybersecurity agencies remediated the findings, and the researchers published full details on 12 March 2021.
Key takeaways
- Sakura Samurai found 10 exposed
.gitdirectories and 23 exposed.envfiles across Indian central and state government sites, exposing credentials for MySQL, SMTP, Redis, SMS services and more. - Its report counted 35 exposed credential pairs, five exposed private keys, more than 13,000 personal records and dozens of police reports.
- A server running an outdated Apache Struts component gave remote code execution, and credentials in its Tomcat configuration let the researchers hijack a user session on a government financial application.
- This was research under a disclosure programme, not a criminal attack. India's NCIIPC and CERT-In remediated the issues, and the researchers say all 34 pages of findings were addressed.
- The identity lesson: configuration files are credential stores, and one misconfigured web server can publish every secret an application uses.
At a glance
| Organisations | Indian government ministries and state governments, including Kerala, West Bengal, Bihar, Tamil Nadu, Maharashtra and Delhi departments, and the Satara Police Department |
|---|---|
| When | Research in early February 2021; announced 8 February 2021; full details published 12 March 2021 |
| Attacker | None known. Found by the ethical hacking group Sakura Samurai (Jackson Henry, Robert Willis, Aubrey Cottle, John Jackson) with collaborator Zultan Holder, under India's NCIIPC Responsible Vulnerability Disclosure Program |
| Entry point | Publicly reachable .git directories, .env files, .bash_history files and SQL dumps on government web servers; an outdated Apache Struts server |
| Identities abused | Hard-coded database, SMTP, PHPMailer, Redis, SMS and WordPress credentials; exposed RSA private keys; Tomcat manager credentials; a hijacked application session |
| Impact | Potential access to government databases, servers and a financial application; researchers were exposed to more than 13,000 personal records and police reports; no confirmed malicious use |
| Category | NHI. Incident class: confirmed NHI breach (exposed credentials used by researchers under India's disclosure programme) |
What happened
Sakura Samurai tested Indian government assets under the Responsible Vulnerability Disclosure Program run by the National Critical Information Infrastructure Protection Centre (NCIIPC). Jackson Henry and Zultan Holder enumerated subdomains and quickly found exposed .git directories. Using git-dumper, the team pulled the projects and found hard-coded credentials for applications and servers. Within hours, the group says, it had identified 10 exposed .git directories, at organisations including the governments of Bihar, Tamil Nadu and Kerala and the Jharkhand Police Department.
Further scanning turned up 23 exposed .env files, which the researchers say mostly included "credentials for SMTP, MYSQL, REDIS, SMS Services, and Google Recaptcha keys and secrets". They also found exposed .bash_history files, two of which contained database passwords, five exposed RSA private keys and a WordPress configuration file with database credentials. Robert Willis found a police department directory full of sensitive police reports, and an exposed SQL file held about 13,000 personal records from a government youth employment programme.
The researchers then showed what an attacker could do with a foothold. John Jackson ran a public exploit for CVE-2017-5638 (Apache Struts) against a Government of Kerala financial server and gained remote code execution. Aubrey Cottle found Tomcat management credentials in the server's configuration, used the manager panel to see active sessions, and took over a randomly chosen user's session on the financial application by setting its session cookie. "Full control of the account was achieved," the group wrote, and it stopped there.
Disclosure was not smooth. Sakura Samurai involved the US Department of Defense Cyber Crime Center (DC3) before reporting, and complained publicly about slow responses. According to BleepingComputer, National Cyber Security Coordinator Lt. Gen. Rajesh Pant told the Hindustan Times on 21 February 2021 that "Remedial actions have been taken by NCIIPC (National Critical Information Infrastructure Protection Centre) and Cert-IN". On 12 March the group said that "all 34-pages of our reported vulnerabilities have been adequately remediated" and published the details.
Timeline
| Date | Event |
|---|---|
| 4 February 2021 | The US DC3 makes initial contact with the Indian government about Sakura Samurai's findings. |
| 8 February 2021 | Sakura Samurai announces publicly that it breached Indian government systems and contacts the NCIIPC. |
| 20 February 2021 | Sakura Samurai publishes a redacted summary of its findings. |
| 21 February 2021 | India's National Cyber Security Coordinator says remedial action has been taken, according to the Hindustan Times as quoted by BleepingComputer. |
| 12 March 2021 | With remediation complete, Sakura Samurai publishes full technical details. |
How it happened: the identity attack path
- Exposed repositories and config files. Government web servers served
.gitdirectories,.envfiles and shell history to the internet. - Harvested machine credentials. The files contained passwords and keys for databases, email, Redis, SMS gateways and WordPress, plus five RSA private keys.
- Remote code execution. An unpatched Apache Struts flaw gave the researchers a shell on a Kerala government financial server.
- Credentials on the host. Tomcat's configuration held management credentials, which opened the manager panel and its list of active user sessions.
- Session hijack. Replaying a session identifier gave full control of a user's account on the financial application.
Impact
- Exposed credentials: 35 credential pairs for servers and applications, five private keys and database passwords in shell history, according to the researchers.
- Personal data: more than 13,000 personal records and dozens of police reports, some with forensic data, were publicly reachable.
- Potential impact: the researchers say their access could have allowed ransomware, crypto mining, data theft and lateral movement across state networks. No malicious use has been reported.
What this means for NHI governance
Every credential in this case belonged to an application or a server, not to a person: database logins, mail relay passwords, SMS gateway keys, private keys and application server manager accounts. None of them were hard to find. They sat in files that web servers should never have served, and nothing alerted anyone that they were public.
This is the same pattern as the United Nations breach the same group reported a month earlier. Deploying code with its repository metadata and environment files, and keeping secrets in those files, turns a single web server misconfiguration into a credential leak for every connected system. The fix is not only to block the files but to stop putting secrets in them at all. See our Secrets Management Guide and Public Sector Identity Security Guide.
Recommendations
- Block repository and environment files at the web server. Deny requests for
.git,.env, shell history and backup files, and exclude them from deployment packages. - Move secrets out of configuration files into a secrets manager. Applications should fetch credentials at runtime from a managed store. See our Secrets Management Guide.
- Inventory and rotate exposed keys and passwords. Treat every credential in an exposed file as compromised and rotate it. See the Leaked Credential Response Playbook.
- Scan your own external footprint. Run the same subdomain enumeration and file discovery attackers use, and fix what you find first.
- Patch internet-facing application servers and protect management interfaces. Keep manager consoles off the internet and their credentials out of readable configuration.
- Make disclosure programmes responsive. Name an owner for each report and publish expected response times, so researchers do not have to escalate publicly.
Frequently asked questions
Was the Indian government hacked in 2021?
Ethical hackers from Sakura Samurai breached many Indian government systems in February 2021 while testing under the government's vulnerability disclosure programme. They reported 34 pages of findings, which Indian agencies remediated. No malicious attack has been reported.
What did the researchers find?
35 exposed credential pairs, five exposed private keys, exposed .git and .env files, more than 13,000 personal records, police reports, a remote code execution flaw on a financial server and a session hijacking chain on a government application.
Why are exposed .env files dangerous?
A .env file usually lists the usernames, passwords and API keys an application uses to reach its database, mail server and other services. If a web server serves the file publicly, anyone can read those secrets and connect as the application.
Related NHI Mgmt Group resources
United Nations Breach 2021 · Emerald Whale Breach · Secrets Management Guide · Public Sector Identity Security Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Hard-coded credentials in configuration files appear again and again in our breach database. We help public and private sector teams find the secrets they already expose, move them into managed storage and assign owners who rotate them. See our NHI and AI agent security training.
References
- Sakura Samurai (John Jackson): Indian Government Breached, Massive Amount of Critical Vulnerabilities (20 February 2021)
- Sakura Samurai (John Jackson): Indian Government Breach, Disclosure (12 March 2021)
- BleepingComputer: Researchers hacked Indian govt sites via exposed git and env files (12 March 2021)