标题： 《邮递员：在PosteID/SPID边界的伦理黑客之旅》 显示英文标题

标题： The Postman: A Journey of Ethical Hacking in PosteID/SPID Borderland

摘要： 本文介绍了一项我们对PosteID进行的漏洞评估活动，PosteID是意大利邮政公司（Poste Italiane）实现的意大利公共数字身份系统（SPID）。 该活动导致发现了一个关键的权限提升漏洞，最终得到了修复。 整个分析和披露过程为道德黑客社区提供了一个有价值的案例研究。 在本工作中，我们介绍了技术步骤和披露过程的详细信息。 显示英文摘要

摘要： This paper presents a vulnerability assessment activity that we carried out on PosteID, the implementation of the Italian Public Digital Identity System (SPID) by Poste Italiane. The activity led to the discovery of a critical privilege escalation vulnerability, which was eventually patched. The overall analysis and disclosure process represents a valuable case study for the community of ethical hackers. In this work, we present both the technical steps and the details of the disclosure process.