C-DAC e-Sushrut Sensitive Data Exposure and Cryptographic Failure Vulnerability

A vulnerability in the C-DAC e-Sushrut Hospital Management Information System (HMIS) has been identified, allowing for the unauthorized disclosure of sensitive information and cryptographic keys. This issue arises from the presence of hardcoded AES encryption keys in client-side JavaScript, which can be accessed and extracted by an unauthenticated remote attacker. The successful exploitation of this vulnerability could lead to the exposure of sensitive data and a compromise of cryptographic protections on the affected system.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive data and cryptographic keys, undermining the security of encrypted information on the system.

Remediation

Users are advised to contact C-DAC for upgrading the e-Sushrut HMIS to the latest version.