U.S. Dept Of Defense · Report #235605
Remote Code Execution (RCE) in DoD Websites
Validstatus
criticalseverity
17upvotes
17 Apr 2018disclosed
Summary
A remote code execution (RCE) vulnerability was found on a Department of Defense (DoD) website which could have enabled an attacker to execute remote commands on the web server. @joaomatosf was able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a benign command. This was a very clever demonstration. Impressive work!
Thank you for supporting the DoD Vulnerability Disclosure Program!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.