The Republic of Maldives Government

The Republic of Maldives Ministry of Defence Laravel Debug Leak

May 2026 — Vulnerability Disclosure Program

The National Cyber Security Agency (NCSA) of Maldives hosts what they officially call a Bug Bounty Program here. Personally, I would argue it aligns more closely with a Vulnerability Disclosure Program (VDP), given the lack of financial rewards. However, successful researchers are recognized with a Certificate of Appreciation and a spot on their public leaderboards, where points dictate your rank.

Below is a snapshot of how the official NCSA Bug Bounty Hall of Fame leaderboards look as of May 24, 2026.

If it wasn't for a random connection on LinkedIn posting their certificate of achievement, I would have never known this responsible disclosure program even existed. Fired up by the discovery, I enabled my VPN and kicked off my usual methodology: subdomain enumeration. From there, I manually reviewed each discovered subdomain inside a Chrome browser. My goal at this early stage wasn't to throw automated tools at the targets, but rather to get an initial feel for the technology stacks in scope and to map out rough expectations for the attack surface.

Eventually, I stumbled across the official website for The Maldives' Ministry of Defence (defence.gov.mv). On first glance, nothing seemed out of the ordinary. I scrolled through the pages, clicked around the interface, checked the Wappalyzer browser extension, and explored Chrome Developer Tools looking for any interesting anomalies.

Then, I noticed a search bar sitting in the top right corner of the screen. Whenever I see a search input, my immediate instinct is to test for Client-Side Injection vulnerabilities, specifically HTML Injection and Cross-Site Scripting (XSS). To test how the application handled raw HTML rendering, I submitted a simple, classic payload: <u>test</u>.

Instead of a standard search results page or a clean "No results found" message, I immediately triggered a catastrophic backend error. The application crashed, rendering a full Laravel Debug mode interface. This happened because the payload inadvertently intersected with a critical Database Exception.

As revealed in the screenshots, App Debug was explicitly set to true, and the App Env was configured as local. Despite the configuration indicating a "local" environment, this system was completely exposed and publicly accessible from anywhere on the internet without restriction.

Rather than handling the error gracefully, the server returned a comprehensive, interactive stack trace powered by the Flare/Ignition error handler. This exposed highly sensitive infrastructure details, providing a textbook example of Information Disclosure. It explicitly leaked the SQL error SQLSTATE[42S22]: Column not found: 1054 Unknown column 'title' in 'where clause', revealed the precise mapping of the server's local file structure, calling out specific paths such as /app/Livewire/SiteSearchComponent.php and the raw SQL query being executed is visible: select count(*) as aggregate from articles where title LIKE ? or content LIKE ?. Because the application's underlying database schema was missing the title column in the articles table, my input broke the query logic entirely, dumping the internal state of the framework directly to the browser.

To secure the application against this level of exposure, the developers need to update the production environment file (.env) by setting APP_DEBUG=false and APP_ENV=production. This completely disables Laravel's interactive debugging interface on the public internet. Finally, the application should be configured to use generic, user-friendly custom error pages (like a standard "500 Server Error" page) for any unhandled exceptions. This ensures that internal database queries, application logic, and local server file paths are safely hidden from public view.

I submitted this finding on the morning of May 5, 2026. On May 24, 2026, I received an email from the NCSA Admin Team confirming that the vulnerability had been remediated and the case was officially closed. Since this was my first successful finding, they sent another email requesting my enrollment consent to officially participate in the Bug Bounty Program and display my handle on the public leaderboard. After registering my details, I was thrilled to see my name officially listed among the contributors.