TikTok · Report #1024575
RCE on TikTok Ads Portal
Validstatus
criticalseverity
312upvotes
15 Apr 2021disclosed
Summary
The video upload endpoint on the TikTok Ads portal was potentially susceptible to remote code execution (RCE) due to a ffmpeg misconfiguration. We thank @ bubbounty for reporting this to our team and confirming the resolution.
During my research on the TikTok Ads portal I found a RCE thought the video creation process resulting to a root access on the system mainly due to a misconfugration ffmpeg. A simple id and ls commands results were reported and the TikTok team fixed the weakness quickly.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.