Leaked account lead to RCE
Hello guys welcome to my new writeup, today i will explain how did i got from leaked accounts lead to RCE.
First of all, i tried to look at waybackurls if there was something that could be intersting but didn’t found anything also i tried with subfinder still nothing.
so i started to look at the source and the website himself and i found something intersting.
Initial Research
A JavaScript file exposed a function that could retrieve account information by ID. I started testing the function to see whether it was actually working and discovered that it did not have any rate limiting.
Credential Leak
After testing different IDs, I eventually found a valid account and received credentials in the response.
I tried logging in with the credentials, and it worked.
I did not report the vulnerability immediately because I wanted to understand whether it could lead to something more serious.
File Upload
While testing the application, I noticed that I could upload files, so I started testing different file types and checking common upload restrictions. Files such as PHP, JavaScript, and SVG were rejected, but the server accepted .shtml files.
After researching this behavior, I found that the server supported Server-Side Includes (SSI), which allowed me to execute server-side commands
For testing purposes, I was able to control the command input through an HTTP header.
Remote Code Execution
I continued testing and confirmed that this could lead to Remote Code Execution. Some requests were blocked by the server’s firewall, so I continued testing different encoding techniques until I was able to bypass the firewall and obtain a reverse shell.
The Final Attack Chain
Takeaway
Note: The vulnerabilities were responsibly reported, patched, and rewarded. I cannot disclose the company or any identifying details. This was my first bug bounty report.