School student raises alarm over bug in IRCTC's e-ticketing platform, helps fix it

New Delhi: A school student from Chennai identified a bug in Indian Railway Catering and Tourism Corporation (IRCTC)'s online ticketing platform. The teenager not only informed the railways of the security error but also helped them fix it.

P Renganathan, 17, realised that the bug could have exposed millions of passengers and their private information. The bug has now been fixed, the IRCTC acknowledged. 

According to a report, Renganathan was logging into the IRCTC site for book a ticket, when he realised that he could access the details of other passengers. The critical Insecure Object Direct References (IODR) vulnerability on the website helped him to access the journey details of other passengers including name, gender, age, PNR number, train details, departure station, and date of journey, as per an IANS report.

“I accidently discovered a critical IDOR that leaks the transaction details of millions of travelers, when I was trying to book tickets on August 30. It was the most common bug. Immediately, I reported about it to the Indian Computer Emergency Response Team (CERT-In),” P Renganathan from Tambaram told IANS.

If accessed by a hacker, they could have ordered food in the name of another passenger, changed the boarding station, and even cancelled the ticket without the knowledge of the passenger. Further, there was the risk of compromising details of millions of passengers.

The IT wing of the IRCTC took note of the complaint, and resolved the vulnerability issue in four days. “Our e-ticketing system is well protected (now). The issue was reported on August 30 and it was fixed on September 2,” an official said. On September 11, 2021, Renganathan also received a mail thanking him for reporting the incident.

The teenager has recieved similar acknowledgments from Linkedin, the United Nations, Nike, and several others for alerting them of the vulnerabilities in their websites. Renganathan wants to pursue a career in Computer Science, while continuing independent research on security of web applications.

(With agency inputs)