TECHNOLOGY SECURITY ALERT – Exploitation of Ellucian Banner System Vulnerability – Update #1 – IFAP
Our ongoing research with targeted institutions has led us to a broader concern regarding the front-end registration portals used by institutions. Specifically, some institutions are using third-party software as front-end access points to the Ellucian Banner System and similar administrative tools. We strongly encourage every institution to review these third-party front-end applications to ensure that they are not introducing vulnerabilities (in need of patches) or increasing the risk of a potential future issue through automation attacks. An automation attack, in this context, uses automated scripts or robotic process automation to rapidly fill forms through the institution’s front-end system and submit them in the hope of gaining accounts. We encourage all institutions to consider using human validation checks as part of front-end portal submission processes.
Additionally, we encourage institutions to continue to provide Federal Student Aid (FSA) with the status of their efforts to validate the correct versions and the use of the Ellucian Banner System and other third party software that may be in use if they suspect fraudulent accounts may have been created. The U.S. Department of Education (Department) is continuing to work with colleges and universities to determine what impact, if any, the Ellucian Banner System vulnerability may have had. To date, based on reports from targeted institutions, we have not found any instances where the Ellucian Banner System vulnerability has been exploited or is related to the issues described in the original alert.