# Attacking HelpDesks Part 1: RCE Chain on DeskPro, with Bitdefender as a Case Study

Broken access control on DeskPro API endpoints leaked JWT secret and admin emails, enabling forged admin JWT and Twig deserialization RCE.

- Payout: $5,000
- Severity: critical
- Program: Bitdefender
- Credited: Abdulrahman Nour
- Disclosed: 2020-03-28
- CVE: CVE-2020-11463, CVE-2020-11464, CVE-2020-11465, CVE-2020-11466, CVE-2020-11467
- Write-up quality: 8/10
- Original: https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study
- Tags: domain:web impact:privesc impact:rce kind:bounty platform:blog sev:critical tech:jwt tech:php technique:chained vuln:access-control vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** DeskPro on-premise helpdesk (API endpoints, JWT usersource app, theme template editor)
**Root cause:** Multiple /api endpoints failed to validate user privilege, exposing JWT usersource secret and agent list; theme template editing passed attacker-controlled Twig variables into PHP unserialize, enabling POP gadget chains.
**Steps:**
1. Register guest account at /en/register and activate.
2. POST credentials to `/api/v2/api_tokens` to get API token; set `Authorization: Basic <base64 token>`.
3. GET `/api/apps/packages/deskpro_us_jwt?usersource_type=user` to leak JWT secret (or PUT same endpoint with `enable_usersource:true` and chosen `secret` to enable it).
4. GET `/api/people?is_agent=1` to enumerate admin emails (can_admin=true).
5. Forge HS256 JWT for admin email and authenticate via `/login/authenticate-callback/6?jwt=<token>`.
6. Generate Guzzle FnStream POP chain with PHPGGC, PUT it into `Theme::layout.html.twig` via `/portal/api/style/edit-theme-set/template-sources` using `{{var_dump(app.getUser().unserialize(p))}}`.
7. Visit `/admin-preview-1/new-ticket` to trigger deserialization and execute code.
**How found:** Team targeted popular self-hosted helpdesks, noting DeskPro had no recent CVEs/advisories since 2007/2015, suggesting overlooked rather than robust; enumerated API endpoints and found missing privilege checks.
**Exploitation:** Self-register a guest, obtain API token, abuse IDOR on /api/apps to leak or set the JWT usersource secret, enumerate admin email via /api/people, forge admin JWT, log in, then inject a PHPGGC Guzzle FnStream gadget into a theme template and trigger unserialize on preview to run arbitrary PHP.
**Escalation:** Chained four access-control leaks (JWT secret, agent list, email creds, tickets) into privilege escalation to admin, then deserialization to RCE; helpdesk could pivot into corporate intranet.
**Insight:** Helpdesk apps expose many /api endpoints that skip per-object privilege checks; enumerate app/usersource endpoints (e.g. /api/apps/packages/*) for secret leakage, and check template engines that expose unserialize via accessible context variables.