The Carrier That Committed Everything
Viva Dominicana is one of the Dominican Republic’s major telecommunications carriers. Millions of subscribers. Television services. Mobile. Internet. The kind of company that handles the communications infrastructure a country depends on.
Their main website at viva.com.do had a .git directory accessible via HTTP. Not just the config file — the entire pack file. 422 megabytes. 15,687 files in the index. Thirteen commits spanning April 2020 to January 2021. Fully clonable via dumb HTTP protocol.
Inside: WordPress 4.9.7 (released 2018, ancient by any standard, riddled with known CVEs), database credentials, complete authentication keys and salts, four SQL database backup files, seven WordPress admin user accounts with Gravatar hashes, and evidence of an active compromise — a crypto spam post injected by one of those user accounts.
And that was just the main domain. The same .git exposure replicated across recargas.viva.com.do and wsapp.viva.com.do. Their internal GitLab instance at gitlab.viva.com.do was live with public projects visible. And servicekit.viva.com.do was running ManageEngine ServiceDesk Plus version 9.3 — a 2016-era build with multiple known pre-authentication remote code execution vulnerabilities.
Update (March 2026): The .git exposure at viva.com.do remains live. A second scan confirmed the internal GitLab URLs are still visible in the git config, pointing to three internal repositories: viva-apps/web-viva.git, viva-apps/helpdesk.git, and viva-apps/web-channel.git.
The Database Credentials
The git repository contained a backup of wp-config.php with production MySQL credentials:
Database: [REDACTED]
Username: [REDACTED]
Password: [REDACTED]
Plus the complete WordPress authentication key and salt set — eight cryptographic values that control session security. With these values, an attacker can forge valid WordPress authentication cookies for any user account without knowing their password.
Four SQL database dumps from 2017 were committed to the repository, containing the full WordPress database at two different points in time. User tables, post content, configuration data — all recoverable from git history.
Seven Admin Users Exposed
WordPress user enumeration via the REST API revealed seven accounts with full Gravatar hashes:
Efrain Castillo (ecastillo) — ID 20
logandosec — ID 18
Luis Ogando (logando) — ID 9
Nieves Cespedes (ncespedes) — ID 11
Pamela Santos (pamela-santos) — ID 22
patrick — ID 12
rgarcia — ID 19
One of these accounts — Efrain Castillo, ID 20 — was associated with a crypto spam post injected into the site. This is a strong indicator of account compromise, likely through credential stuffing or brute force against the exposed WordPress installation.
The ManageEngine Problem
ManageEngine ServiceDesk Plus at servicekit.viva.com.do returned version 9.3, build 9300 — approximately from 2016. This version predates multiple critical security patches including pre-authentication remote code execution vulnerabilities.
Exposed endpoints confirmed the service is actively running: /SetUpWizard.do, /servlet/AJaxServlet, /api/v3/requests, /WOListView.do, /ViewRequest.do — all returning HTTP 200.
A telecom company’s IT service management platform, running a decade-old version with known RCE vulnerabilities, accessible from the internet.
Every Police Station in the Country
Separate from the Viva findings, the Dominican Republic’s National Statistics Office operates a GeoServer at portalgeoestadistico-geo.one.gob.do. It runs GeoNode 4.0.0 with Web Feature Service (WFS) enabled. No authentication. Access constraints: NONE. The GeoServer title was still configured as “example.com” — the default placeholder.
Twenty-eight WFS layers were dumped, totaling 433 MB of GeoJSON:
Security infrastructure:
1,003 police, military, and security institution GPS locations
2,470 government office locations
24 embassy and consulate locations
246 emergency/relief institutions
National infrastructure:
7,237 schools with GPS coordinates
10,000+ religious institutions
7 international airports
10,000+ roads and highways
7,873 waterways
Administrative boundaries:
32 provinces (complete polygon data, 55 MB)
986 municipalities
1,004 districts
1,608 census sections (179 MB)
The security institution layer is the most sensitive — precise GPS coordinates for every police station, military installation, and security facility in the Dominican Republic. Combined with the administrative boundary data, this enables complete mapping of the country’s security infrastructure.
The Car Rental With Everything Exposed
autodominicana.rent — a car rental platform — had its production .env file publicly accessible. The full inventory:
MySQL database credentials (host, username, password, database name)
Laravel APP_KEY (enables session forging and potential RCE)
Twilio SMS credentials (SID, token, phone number, messaging SID — active SMS sending capability)
RentProg API token
Additionally, a 517 MB Laravel debug log at /storage/logs/laravel.log was publicly downloadable — containing server paths, error traces, and application state.
A small car rental company with more exposed secrets than most of the government sites scanned.
Phase 2: The Universities
Added March 2026
Phase 1 covered 1,340 domains — government, telecom, and private sector. But the Dominican Republic has 40+ universities, and the education sector tells a different story than the hardened .gob.do domains.
Using certificate transparency log harvesting (THOT), we discovered 1,522 .edu.do domains. Combined with 43 curated university targets, 1,192 additional .do domains, and 36 bank domains, the total scan scope expanded to 4,129+ domains across 7 custom scripts.
phpMyAdmin on Three Subdomains
Universidad Dominicana O&M (uod.edu.do) has phpMyAdmin v5.2.1 accessible on the internet — not on one subdomain, but three: the main site, the admissions system, and the academic system. Three database admin panels protecting student records, grades, and PII, sitting behind nothing but a login form.
A University Running PHP From a Test Directory
UCATECI (ucateci.edu.do) left info.php accessible — a 142KB full phpinfo dump. It revealed PHP 7.4.33 (end of life since November 2022, no security patches), Apache 2.4.52, the admin’s email address, and a document root of /var/www/html/prueba. “Prueba” is Spanish for “test.” A production university website served from a test directory running end-of-life PHP.
The .git That Reveals the Server
UAFAM’s virtual learning platform (virtual.uafam.edu.do) had its .git directory exposed. The HEAD file pointed to MOODLE_405_STABLE. The config revealed it was cloned from GitHub’s Moodle repository. The packed-refs file was 57KB — every Moodle version tag from 1.0 to 5.0. The git logs revealed the server hostname (uafam-moodle-1), that it was deployed by root, and the exact clone date: May 1, 2025.
WordPress Users Across 14 Universities
The WordPress REST API user enumeration endpoint (/wp-json/wp/v2/users) was open on 14 universities, yielding approximately 30 user accounts. But the interesting finding was a supply chain pattern: the accounts rsweb and rssolucionesweb appeared on both UFHEC and UNIREMHOS. Rodriguez Santos Soluciones Web — a single web development company — manages both university websites. One compromised developer, two compromised universities.
The Library That Published Its API Blueprint
ISFODOSU’s library system (biblioteca.isfodosu.edu.do) runs Koha version 23.0503000 and had its complete REST API Swagger specification publicly accessible — 474KB documenting every API endpoint: patron management, checkouts, holds, items, acquisitions, reports, cash registers, and transfer limits. A complete blueprint for anyone wanting to interact with the library’s backend.
FortiGate VPN and Tomcat SSO
Two universities (UNAPEC and UCATECI) exposed FortiGate SSL VPN login portals. UNAPEC’s SSO system runs Apache Tomcat 8.5.57 — outdated with multiple known CVEs. UNPHU runs a REDCap instance (research data collection) where the API responds with “you do not have permissions” — confirming it exists and needs only a valid token.
The Banks Are Fine
In contrast to everything above, the banking sector assessment was clean. All 36 Dominican Republic financial institutions — BanReservas, Banco Popular, BHD, Scotiabank, Promerica, Banesco, APAP, and 29 others — returned zero exploitable findings. CloudFront, Incapsula/Imperva WAFs, properly configured responses. The banks have invested in security. The universities have not.
The Scan Scope
Phase 1: 1,340 domains scanned (February 2026) — government, military, banking, media, education, healthcare, commerce. Eight organizations returned findings.
Phase 2: 2,789+ additional domains scanned (March 2026) — universities, education regulators, banking sector deep dive, full .do TLD sweep. Fourteen new findings across the education sector. Banking sector confirmed clean.
Total: 4,129+ domains. 22 organizations with findings. All remain live as of March 7, 2026.
The findings paint a three-tier picture:
Government and banking: Hardened. WAFs, clean scans, minimal exposure.
Telecom (Viva Dominicana): Catastrophic. Systemic failures across the entire organization, still unpatched a month after initial discovery.
Universities: Broadly vulnerable. phpMyAdmin panels, EOL software, exposed APIs, supply chain dependencies on small web shops.
