E-Arogya

13 -Aadhaar is Not Encrypted in Transit
CWE : CWE-311
Description :
The software transmits sensitive or security-critical data in cleartext in a communication
channel.
Affected Path(s) :
https://earogya.satragroup.in/patient/0/patient-Registration *-Applicable to entire
application
Impact :
Anyone can read the information by gaining access to the channel being used for
communication.
Recommendation :
Encrypt the data with a reliable encryption scheme before transmitting.
Evidence/Proof Of Concept :
Step 1: As seen below all the actions of the user including the aadhar are stored in plain text.