Imgur · Report #206227

Remote Code Execution on Git.imgur-dev.com

Validstatus

criticalseverity

119upvotes

16 Apr 2017disclosed

Summary

GitHub Enterprise Rails static key issue.

The patch released on date 2017/01/31 (https://enterprise.github.com/releases/2.8.7/notes), but two weeks pass, it seems still vulnerable. I think this server is very critical for Imgur, so I reported to the vendor.

Thanks to Imgur Security Team's kindness :)

P.s. Also thanks to @iblue and his amazing finding! http://exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html

How it was found

Hi, Imgur Security Team:

I just found that your GitHub Enterprise Server(https://git.imgur-dev.com/) didn't patch to the latest version(2.8.7). And there is a Rails static key leads to RCE vulnerability!

You can see the PoC from my screenshots :)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original