U.S. Dept Of Defense · Report #212022
Remote Code Execution (RCE) in a DoD website
Validstatus
criticalseverity
7upvotes
1 Jun 2017disclosed
Summary
A remote code execution (RCE) vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @0daystolive and @dly were able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a benign command. This was a very clever demonstration. Thank you!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.