E-Arogya

15 -Insufficient Aadhaar Verification
CWE : CWE-20
Description :
Application is not verifying the aadhaar number from aadhaar portal, due to this an
attacker could misuse the genuine user’s aadhaar numbers to avail a service in TTD
online portal, which results in non availability of resource to genuine user
Affected Path(s) :
https://earogya.satragroup.in/patient/0/patient-Registration *-Applicable to entire
application
Impact :
Aadhaar validation misuse will impact availability of resource to be accessed by genuine
user.
Recommendation :
It is recommended to validate the aadhaar using any biometric or OTP based service.
Evidence/Proof Of Concept :
Step 1: Aadhaar number not verified properly as shown in below screenshots.

Step 2: Any random number can be given and submitted successfully as shown in below
screenshot.