The Postman: A Journey of Ethical Hacking in PosteID/SPID Borderland

This paper presents a vulnerability assessment activity that we carried outon PosteID, the implementation of the Italian Public Digital Identity System(SPID) by Poste Italiane. The activity led to the discovery of a criticalprivilege escalation vulnerability, which was eventually patched. The overallanalysis and disclosure process represents a valuable case study for thecommunity of ethical hackers. In this work, we present both the technical stepsand the details of the disclosure process.