MEDIUM · refiner

Chennai Petroleum Corporation Ltd

2026-10-05 passive check: availability unconfirmed; TLS expiry unconfirmed; header state unconfirmed.

cpcl.co.inbaseline scan 2026-04-27 · daily passive check 2026-10-05 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-05

score 62

Availability

request timed out

TLS

unknown

Headers

6 missing · 0 permissive

Email auth

SPF soft · DMARC quarantine

60

Baseline score · 2026-04-27

Watch

Historical findings · 2026-04-27

  • 01WordPress fingerprint exposed via Link headers (rel=alternate to /wp-json/v2)
  • 02Missing CSP
  • 03Permissions-Policy permits payment and fullscreen — broader than typical
  • 04Soft-fail SPF

TLS security

unknown

Issuer
Unavailable

TLS connection timed out

Email authentication

SPF
soft
DKIM
present
DMARC
quarantine

Hardening headers

0 / 0 / 6present/permissive/missing

  • HSTSmissing
  • CSPmissing
  • X-Framemissing
  • X-Content-Typemissing
  • Referrer-Policymissing
  • Permissions-Policymissing

Lookalike domains

  • cpcl.co.com→ 169.60.151.233 (RIPE-allocated cloud, typosquat cluster)
  • cpcl.in→ 202.71.129.6 (third-party)

Public topology · CT logs

2 total

2 subdomains in CT logs; no sensitive categories flagged.

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

Can CPCL patch King Addons (CVE-2025-8489 CVSS 9.8 KEV) and suppress WordPress version disclosure before the next reconnaissance scan triggers automated exploitation?

Active fingerprints · per host

  • www.cpcl.co.inEOL × 3

    WordPress on Office365 MX (cpcl-co-in.mail.protection.outlook.com)

    • ⚠ WordPress version exposed via /wp-json
    • ⚠ No CSP
    • ⚠ Soft-fail SPF (~all)

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path A: WordPress version detection → CVE matching

effort hours
detect low (bad)
Entry
Identify WP version via wp-json. Enumerate plugins (King Addons, WPBakery).
Pivot
Match to CVE-2025-8489 (King Addons CVSS 9.8 KEV — privilege escalation) or CVE-2024-56286 (WPBakery CVSS 8.2 stored XSS).
Objective
Site takeover via privilege escalation.
#1

Path B: King Addons CVE-2025-8489 unauthenticated privilege escalation

effort hours
detect low (bad)
Entry
Free user registration (if enabled). Specify 'administrator' role in payload.
Pivot
Escalate to admin without authentication.
Objective
Complete site takeover.
#2

Path C: WPBakery CVE-2024-56286 stored XSS

effort hours
detect medium
Entry
Legacy plugin contains stored XSS in page builder.
Pivot
Inject payload via contributor/editor account; admin views; token harvested.
Objective
Backdoor; admin compromise.
#2

Path D: Soft-fail SPF + Office 365 MX → spear phishing

effort days
detect low (bad)
Entry
SPF ~all soft-fail; Office 365 MX shared infrastructure.
Pivot
Spoofed mail from cpcl-alternate.mail.protection.outlook.com may pass alignment.
Objective
Reach inbox with valid SPF; supplier-payment fraud.

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path A · WordPress version detection → CVE matching
factor ~5–10×
pre-AI
WordPress version detection → plugin CVE matching → privilege escalation
Mythos
AI-augmented attacker auto-correlates wp-json fingerprint with current CVE chain in seconds
Path D · Soft-fail SPF + Office 365 MX → spear phishing
factor ~3–5×
pre-AI
Soft-fail SPF + O365 MX → spear-phishing with high deliverability
Mythos
Lure crafting + supplier-network mapping accelerated

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    Audit WordPress core + all plugins; update against CVE-2025-8489

    Host
    www.cpcl.co.in
    CVE
    CVE-2025-8489, CVE-2024-56286
    Fix
    wp-cli: wp plugin list --update=available. Update King Addons → 51.1.35+. Update WPBakery / Elementor / others. Test on staging.
    Owner
    Web Ops
    Validation
    wp plugin status: all current; vulnerable plugin versions absent
  • critical

    Suppress WordPress version disclosure

    Host
    www.cpcl.co.in
    Fix
    Remove Link headers (wp-json). Disable /wp-json/ or require auth. Hide version in HTML meta + HTTP headers.
    Owner
    Web Ops
    Validation
    curl -I | grep wp-json returns nothing
  • critical

    Disable or restrict user registration

    Host
    www.cpcl.co.in
    CVE
    CVE-2025-8489 mitigation
    Fix
    WP Admin → Settings → Membership uncheck 'Anyone can register'. If needed, allowlist @cpcl.co.in only with manual approval.
    Owner
    Web Ops
    Validation
    Public registration with @gmail.com blocked

Tier 2 · within 30 days

  • high

    Add CSP header — nonce-based

    Host
    www.cpcl.co.in
    Fix
    default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline' (only if necessary).
    Owner
    Web Ops
    Validation
    curl -i shows CSP with nonce, no unsafe-inline/eval in script-src
  • high

    Upgrade SPF from ~all to -all after 30-day monitoring

    Host
    cpcl.co.in (email)
    Fix
    Monitor SPF alignment 30 days; replace ~all with -all.
    Owner
    Email Security
    Validation
    dig +short TXT cpcl.co.in shows -all
  • high

    Upgrade DMARC p=quarantine → p=reject

    Host
    cpcl.co.in (email)
    Fix
    After SPF -all + 30-day clean rua, promote DMARC to p=reject.
    Owner
    Email Security
    Validation
    dig +short TXT _dmarc.cpcl.co.in shows p=reject
  • high

    Deploy WAF — block WordPress exploitation patterns

    Host
    www.cpcl.co.in
    Fix
    Cloudflare or ModSecurity OWASP CRS. Custom rules: block /wp-admin/admin-ajax.php admin payloads from non-admin sessions.
    Owner
    Security / WAF
    Validation
    <img src=x onerror=alert(1)> returns 403
  • high

    Audit WordPress user roles + enforce 2FA on admins

    Host
    www.cpcl.co.in
    Fix
    WP Admin → Users → audit each role + last login + 2FA status. Remove inactive users. Wordfence or Two-Factor plugin.
    Owner
    Web Ops
    Validation
    All admin/editor accounts have 2FA enabled

Tier 3 · within 90 days

  • medium

    DKIM signing for Office 365 mail

    Host
    cpcl.co.in (email)
    Fix
    O365 admin: Enable DKIM. Verify alignment with DMARC.
    Owner
    Email Security
    Validation
    Test email shows DKIM-Signature: pass

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.