Basecamp · Report #1456063
RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com
Validstatus
lowseverity
$100bounty
30upvotes
26 Apr 2022disclosed
Summary
@ian reported that jabber.37signals.com and jabber.basecamp.com exposed on port 555 an unauthenticated Java JMX server which was vulnerable to RCE. We've looked into this and found that we forgot to clean up some DNS records when we decomissioned Jabber so the exposed IP address were not part of our infrastructure. We've removed the old DNS entries for jabber.basecamp.com / jabber.37signals.com.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.