Summary

Scope: Presidency and Executive Branch public-facing web infrastructure Method: Passive reconnaissance only (HTTP requests, publicly accessible endpoints)

Table of Contents

1. Cross-Domain Summary & Severity Rankings
2. Shared Infrastructure Analysis
3. Domain 1: presidencia.gob.ec
4. Domain 2: vicepresidencia.gob.ec
5. Domain 3: comunicacion.gob.ec
6. Domain 4: planificacion.gob.ec
7. Domain 5: secretariajuridica.gob.ec
8. Government GitLab (minka.gob.ec) -- Source Code Exposure
9. Appendix: Plugin Version Matrix

Cross-Domain Summary & Severity Rankings

CRITICAL

HIGH

The simon-feijoo slug under the "Direccion de Comunicacion Digital" display name reveals a real person's name (Simon Feijoo) managing government digital communications.

robots.txt Misconfiguration

The robots.txt has an empty Disallow: directive, meaning it explicitly allows ALL crawling of the entire site, including wp-admin paths. This is likely unintentional.

REST API Namespaces

wp/v2, oembed/1.0, yoast/v1, sweep/v1, ea11y/v1,
google-site-kit/v1

Yoast SEO API Exposure

The /wp-json/yoast/v1/get_head endpoint returns:

• Yoast SEO version: 27.0
• Organization schema data
• Social media handles: @comunicacionec (X/Twitter), ComunicacionEcuador (Facebook)
• Logo URL: /wp-content/uploads/2023/11/Logo.svg

Security Posture

• Good: No .env/.git exposed, no debug.log
• CRITICAL: User enumeration wide open, XML-RPC enabled (405 = accepts POST), robots.txt allows all crawling
• Bad: Full REST API accessible, plugin readmes expose versions, no security headers, author sitemap exposes usernames

Domain 4: planificacion.gob.ec

Status: UNREACHABLE (TLS Error) URL: https://www.planificacion.gob.ec Organization: Secretaria Nacional de la Administracion Publica y Planificacion

Findings

• HTTPS: Fails with "self signed certificate in certificate chain"
• HTTP: Also fails (connection refused or redirects to broken HTTPS)
• With www: Self-signed cert error
• Without www: ECONNREFUSED

The domain exists and is referenced in government portals (gob.ec/snp) and CEPAL planning observatory, but the web server has a broken TLS configuration. A subdomain planificacion.presidencia.gob.ec was also found in search results, suggesting the site may have been consolidated under the presidency domain.

Security Assessment

• MEDIUM: Self-signed certificate in production. Users accessing this site must bypass browser security warnings, which normalizes ignoring TLS errors -- a social engineering risk.

Domain 5: secretariajuridica.gob.ec

Status: OFFLINE / UNREACHABLE URL: https://www.secretariajuridica.gob.ec Organization: Legal Secretariat of Ecuador

Findings

• HTTPS with www: ECONNREFUSED
• HTTPS without www: ECONNREFUSED
• HTTP with www: Connection error ("Was there a typo in the url or port?")
• HTTP without www: Connection error

The domain appears completely offline. No DNS resolution or web server is responding. Web searches return no current results for this domain. The Legal Secretariat may have been reorganized or its web presence consolidated into another portal.

Security Assessment

• LOW: Domain is simply not operational. No attack surface exists.

Government GitLab: minka.gob.ec

Discovery

The subdomain minka.presidencia.gob.ec (found in presidencia homepage source) and the domain minka.gob.ec host Ecuador's government GitLab instance.

Key Finding: Sitio-32 Theme Source Code Exposed

Repository: minka.gob.ec/Quinaluisa/traduccion Path: SOURCE/themes/Sitio-32/ Commit: 536849a1a1d9a8ff67f02f0b95a1f7511bdeb2fc Access: Public (no authentication required)

The repository contains the complete source code of the government WordPress theme, including:

Theme Structure (78 items: 15 directories + 63 files)

• oraculo/ -- Centralized content management plugin
• plugins/ -- Bundled plugins (banner-ads-rotator, oraculo)
• ajax/, inc/, js/, css/ -- Core theme assets
• functions.php -- Theme initialization with XSS vulnerabilities
• raw.php -- Unauthenticated data extraction endpoint
• test.php -- PHP unserialization test file
• front-page.php.bck -- Backup file left in production
• storeit.txt -- Binary/encoded data file

oraculo.php -- Critical Vulnerabilities

Hardcoded salt: "ALRTOPER984TNMGDGFDH"
Hardcoded password: "SNAPsitio30v"

• SQL injection via $_REQUEST parameters in image header queries
• File uploads with extension-only validation
• Admin functions without capability checks or nonce verification
• Deprecated mcrypt_* encryption functions
• Direct MySQLi queries without prepared statements

raw.php -- Unauthenticated WP_Query

Accepts date1 and date2 via $_REQUEST, queries all posts in range, outputs raw print_r(). No authentication, no nonce, no input sanitization.

functions.php -- XSS Vectors

• compartir() function outputs unsanitized get_the_title() and get_the_excerpt() in JavaScript strings
• Multiple echo statements without esc_attr(), esc_url(), or wp_kses_post()
• HTTP (not HTTPS) Google Fonts loading

Other Public Repositories on minka.gob.ec

The FirmaEC repositories handle Ecuador's national digital signature infrastructure, suggesting minka.gob.ec is used for critical government code.

Appendix: Plugin Version Matrix

Google Analytics IDs

Key Takeaways

1. Centralized but Vulnerable: Ecuador runs a standardized government WordPress platform (Sitio-32) across executive branch sites. This means a vulnerability in the shared theme or oraculo plugin affects ALL government sites simultaneously.

2. Source Code Exposed: The complete theme source code, including hardcoded credentials, is publicly accessible on the government's own GitLab instance (minka.gob.ec).

3. Inconsistent Security: presidencia.gob.ec and vicepresidencia.gob.ec have user enumeration properly blocked (likely Wordfence), but comunicacion.gob.ec does not -- suggesting per-site configuration rather than centralized policy.

4. XML-RPC + User Enumeration = Brute Force Risk: comunicacion.gob.ec has both user enumeration (3 known usernames) and XML-RPC enabled, creating a direct brute-force attack path.

5. Legacy Code Debt: The oraculo plugin uses deprecated PHP functions (mcrypt), direct SQL queries, and patterns from 2015-era WordPress development. It has not been modernized.

6. No Security Headers: None of the three active domains implement modern security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).

7. Two Domains Unreachable: planificacion.gob.ec has a broken TLS certificate and secretariajuridica.gob.ec is completely offline, suggesting infrastructure neglect.