# RCE on Starbucks Singapore and more for $5600

Unauthenticated imageuploadhandler.ashx on Starbucks Singapore IIS server accepted .aspx uploads, yielding RCE as iis apppool and exposing six regional servers.

- Payout: $5,600
- Severity: critical
- Program: Starbucks
- Credited: Kamil Onur Özkaleli
- Disclosed: 2021-04-04
- Write-up quality: 7/10
- Original: http://www.kamilonurozkaleli.com/posts/rce-on-starbucks-singapore-and-more/
- Library page: https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-rce-on-starbucks-singapore-and-more
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:dotnet technique:fuzzing technique:recon vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** IIS-hosted ASP.NET REST API (imageuploadhandler.ashx) for Starbucks mobile app
**Root cause:** The image upload handler lacked authentication and extension validation, storing attacker-supplied .aspx files in the web-accessible /api directory where IIS executed them.
**Steps:**
1. Enumerate IIS 8.3 short names with tilde enumeration scanner against /api, revealing DOWNLO~1.ASH, EMAIL-~1.ASH, IMAGEU~1.ASH, MAILIN~1.ASH
2. Expand short names: download.ashx, email-bounce.ashx; fuzz `imageuploadFUZZ.ashx` with ffuf to find imageuploadhandler.ashx
3. Read ajaxfileupload.js to learn the request is `multipart/form-data`
4. POST a file with `.aspx` extension containing ASP.NET code to /api/imageuploadhandler.ashx unauthenticated; response returns UUID+extension
5. Access uploaded file at /api/<uuid>.aspx to execute code; run `whoami` returning `iis apppool\cards.starbucks.com.hk`
**How found:** Noticed some mobile app traffic hit .aspx endpoints, inferred IIS server, recalled shubs' IIS talk and Soroush Dalili's tilde enumeration scanner; ran it against /api, spotted IMAGEU~1.ASH, guessed 'U' meant upload, and fuzzed imageuploadFUZZ.ashx to recover imageuploadhandler.ashx; then read ajaxfileupload.js to reconstruct the multipart request format.
**Exploitation:** Unauthenticated attacker uploads an .aspx webshell via multipart/form-data to imageuploadhandler.ashx; server renames to UUID but preserves extension and stores in /api, then attacker requests /api/<uuid>.aspx to execute arbitrary code as the IIS app pool identity.
**Escalation:** whoami output revealed the app pool name cards.starbucks.com.hk, prompting testing of other regional zones; same endpoint and flaw found on Singapore, Hong Kong, Vietnam, Thailand, Malaysia, Cambodia servers.
**Insight:** IIS 8.3 short-name enumeration can leak the first 6 chars of handler filenames; combine with ffuf to reconstruct full names of hidden .ashx handlers, then check whether upload handlers preserve dangerous extensions and store into executable web directories.