Free link 🎈

Hey there!😁

They say a picture is worth a thousand words… but in my case, it was worth a reverse shell, a critical report, and a four-digit bounty.

Also me, two weeks before that: “Ugh, another upload endpoint? Probably just rejects everything except .jpeg and .png. Boring.”

Also me, two weeks after that: “Bro, I just got RCE by uploading a selfie with an evil surprise inside.”

Let’s dive in. 👇

I was scanning subdomains of a fintech company that shall not be named (but rhymes with “MoneyShmash”) using my usual combo:

subfinder -d target.com | httpx -status-code -title -tech

One endpoint caught my eye:

https://media-upload.moneyshmash.com/api/v2/upload/image

With a Content-Type: multipart/form-data and Swagger docs that whispered sweet things like:

{
  "file": "(binary)"
}

Oh yes. A direct image upload endpoint. No auth. No CSRF. Time to tango. 🕺