The Postman: A Journey of Ethical Hacking in PosteID/SPID Borderland
Fuente:
arXiv
Enregistré dans:
| Auteur principal: | |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866913955469852672 |
|---|---|
| author | Costa, Gabriele |
| author_facet | Costa, Gabriele |
| contents | This paper presents a vulnerability assessment activity that we carried out on PosteID, the implementation of the Italian Public Digital Identity System (SPID) by Poste Italiane. The activity led to the discovery of a critical privilege escalation vulnerability, which was eventually patched. The overall analysis and disclosure process represents a valuable case study for the community of ethical hackers. In this work, we present both the technical steps and the details of the disclosure process. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2507_17007 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | The Postman: A Journey of Ethical Hacking in PosteID/SPID Borderland Costa, Gabriele Cryptography and Security This paper presents a vulnerability assessment activity that we carried out on PosteID, the implementation of the Italian Public Digital Identity System (SPID) by Poste Italiane. The activity led to the discovery of a critical privilege escalation vulnerability, which was eventually patched. The overall analysis and disclosure process represents a valuable case study for the community of ethical hackers. In this work, we present both the technical steps and the details of the disclosure process. |
| title | The Postman: A Journey of Ethical Hacking in PosteID/SPID Borderland |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2507.17007 |