Starbucks · Report #1027822
Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg
Validstatus
criticalseverity
247upvotes
9 Dec 2020disclosed
Summary
ko2sec discovered an .ashx endpoint on mobile.starbucks.com.sg intended for image files permitted unrestricted file type uploads which could lead to a potential RCE. ko2sec's thorough analysis provided additional endpoints on other out of scope domains that shared this vulnerability.
@ko2sec — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.