# Discovering a zero day and getting code execution on Mozilla's AWS Network

Unauthenticated WebPageTest on Mozilla AWS allowed header-spoofed localhost access plus a zip-extraction race to achieve PHP code execution.

- Payout: $500
- Severity: critical
- Program: Mozilla
- Credited: Shubham Shah, Mathias Karlsson
- Disclosed: 2019-03-19
- Write-up quality: 8/10
- Original: https://blog.assetnote.io/bug-bounty/2019/03/19/rce-on-mozilla-zero-day-webpagetest/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:php technique:race-window technique:source-review vuln:auth-bypass vuln:file-upload vuln:race-condition vuln:rce

**Target:** WebPageTest instance (PHP web app) on Mozilla AWS
**Root cause:** common.inc trusts the HTTP_FASTLY_CLIENT_IP header and overwrites REMOTE_ADDR, bypassing the 127.0.0.1 check in workdone.php; SecureDir deletes uploaded PHP files only after extraction, leaving a race window.
**Steps:**
1. Recon finds unauthenticated WebPageTest at `wpt-vpn.stage.mozaws.net` and `wpt1.dev.mozaws.net`.
2. Run a traceroute via the UI to obtain a valid test ID (e.g. `171124_GW_9`).
3. POST a malicious zip to `/www/work/workdone.php` with header `Fastly-Client-IP: 127.0.0.1` to pass the REMOTE_ADDR check and trigger `ExtractZipFile` into the test path.
4. Concurrently request the extracted PHP file at its known path before `SecureDir` unlinks it (Burp Intruder ~200 threads / Turbo Intruder).
5. PHP executes, confirming RCE via `phpinfo()`.
**How found:** Assetnote Continuous Security flagged unauthenticated WebPageTest instances on Mozilla's attack surface; source review of workdone.php revealed zip extraction and a 127.0.0.1 check, then common.inc revealed the Fastly-Client-IP header trust that defeats it, and SecureDir's post-extraction deletion suggested a race window.
**Exploitation:** Attacker uploads a zip containing a PHP webshell to workdone.php while spoofing localhost via the Fastly-Client-IP header, then races requests to hit the extracted shell before SecureDir deletes it, achieving code execution on the Mozilla AWS host.
**Insight:** When a localhost-only check exists, grep the app's bootstrap for headers that overwrite REMOTE_ADDR (proxy/CDN client-IP headers); and when a sanitizer runs after extraction, race the window rather than defeating the sanitizer.