U.S. Dept Of Defense · Report #211381
Remote Code Execution (RCE) in a DoD website
Validstatus
criticalseverity
29upvotes
13 Apr 2017disclosed
Summary
A remote code execution (RCE) vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @joaomatosf, was able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a benign command. This was a very clever demonstration. Thanks @joaomatosf, and well done!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.