Customer identity, unit designation, and specific operational details classified. Engagement scope and findings published in generalised form with authorisation.
The Customer
The customer is an active-service Ukrainian military unit operating ERP infrastructure to manage logistics, supply chain coordination, and resource allocation. The system handles data with direct operational relevance to active military activities.
The unit's technical staff had deployed the ERP system under wartime conditions, prioritising operational speed over security hardening. The system had not undergone formal security assessment since deployment.
The Challenge
In February 2025, the unit's IT leadership identified that the ERP system's internet-facing components required security assessment. The specific concern was not abstract — adversary interest in Ukrainian military logistics data is well-documented. State-aligned threat actors, particularly those associated with GRU and FSB, have consistently targeted military supply chain and logistics systems since the beginning of the full-scale invasion.
The unit was not conducting a compliance exercise. The question was direct: does this system expose logistics data that an adversary could use, and if so, how quickly can we close the exposure?
AmonSul was engaged to conduct a focused penetration test of the ERP environment — application layer, authentication mechanisms, and data access controls — with an accelerated timeline and immediate-action reporting.
The Approach
Scope
The assessment was scoped to the ERP application layer and its supporting infrastructure: the web-facing interface, authentication and session management mechanisms, user privilege model, API endpoints, and underlying database access controls.
Network-layer testing of broader unit IT infrastructure was out of scope. The unit required a focused, rapid assessment of the specific system rather than a broad infrastructure review.
Authentication and Session Management
AmonSul's initial assessment of the authentication layer identified several weaknesses in the session management implementation. Session tokens were generated with insufficient entropy, creating a theoretical token prediction path. Password reset flows contained a logic flaw allowing enumeration of valid usernames without triggering account lockout. Multi-factor authentication was not enforced for privileged accounts accessing logistics data modules.
These vulnerabilities were individually rated medium severity — no single one provided direct unauthorised access to data. Combined, they created a realistic attack path that a motivated adversary with moderate skill could follow.
Risk Assessment in Operational Context
Discovered vulnerabilities were rated medium severity using standard CVSS scoring methodology — they required authentication, and neither provided direct system-level access.
AmonSul's assessment escalated the operational risk classification significantly above the CVSS rating. In the context of an active military operation:
- The reporting module misconfiguration provided a broader view of logistics patterns across units than any single low-privilege user should have access to
- The combination of the authentication weaknesses created a realistic credential compromise path that did not require exploitation of any single high-severity vulnerability
The report documented a complete attack chain: exploit the session token entropy weakness to compromise a session, and use the reporting misconfiguration to build a broader operational picture.
The operational consequence of this chain being executed by a state actor was assessed as high, regardless of the technical CVSS ratings of the individual components.
The Outcome
The report was delivered within 24 hours of testing completion. The unit's technical staff remediated all identified vulnerabilities within the following week:
- Session token generation was replaced with a cryptographically secure implementation
- MFA was enforced for all accounts with access to logistics data modules
AmonSul performed verification testing after remediation to confirm each fix was effective. All vulnerabilities were confirmed remediated.
The ERP system has not been successfully compromised in the period since the engagement. The unit's IT leadership has implemented a standing requirement for security assessment of any externally-facing system before operational deployment.
The engagement reinforced a principle that AmonSul applies consistently in military and defence sector work: standard severity rating frameworks are calibrated for commercial contexts. The operational consequence of a data exposure in an active conflict environment requires a separate risk assessment that reflects the actual adversary and the actual data at risk — not an abstract CVSS score.
“In wartime, there is no such thing as a medium-severity finding in a logistics system.”