OSM row: CBSE admits OnMark portal vulnerabilities, says efforts underway to rule out other weaknesses

New Delhi: The Central Board of Secondary Education (CBSE) has acknowledged vulnerabilities in the OnMark portal used by its service provider and said that they have been contained. It added that efforts are underway to rule out any other exploitable weaknesses.

In a statement, the CBSE said that it is “closely monitoring” the situation, “... vulnerabilities in the OnMark portal of our service provider are being flagged in the public domain. An expert team of cybersecurity professionals has been deployed over the last few days from across various arms of the government as well as the IITs to fortify these systems, including taking them over to a more secure setup.”

“We are grateful to all alert citizens and ethical hackers pointing out such weaknesses, and have gotten in touch with some of them directly. We request that any others reach out to our security teams at [e-mail] for any further inputs,” it further said.

Ethical hacker Nisarga Adhikary pointed out yet another loophole in the portal. He hinted at a serious security flaw and showed how they could “paginate and enumerate” answer sheets and question papers. "... anyone on the Internet can download any scanned booklet — across institutions. Multiple institutions are using the same bucket, insanely insecure,” he posted on X with photos showing how the papers were possibly photographed by a mobile phone, but not scanned.

The controversy began when Nisarga Adhikary, a Class 12 student, claimed that he had accessed CBSE systems and uncovered security flaws in the OSM portal. Nisarga pointed out that the government ignored him when he raised “critical vulnerabilities” in the portal.

Another student, Sarthak Sidhant, had highlighted preferential treatment to a particular service provider.