Unauthenticated remote code execution.
A public-facing application accepted crafted input that resulted in server-side command execution.
- Discovered (complete)
- Proven (complete)
- Fixed (not yet published)
- Retested (not yet published)
What they were shipping
A public-facing production application. Product details are redacted.
What we found
An endpoint reachable without authentication passed attacker-controlled input into a code path that executed it on the server.
How we proved it
Proof was limited to demonstrating that execution was possible, per our rules of engagement. The payload and affected route are withheld.
Business impact
Anyone on the internet could run commands on the application server, with whatever access that server had to data, secrets and internal systems.
Fix
Remove the path from user input to execution entirely, validate input against a strict allow-list, and run the service with the least privilege it needs.
Retest
Retest status not published for this case.