# Hacking Imgur for Fun and Profit

Exposed Imgur dev environment leaked keys.php credentials and an unpatched Elasticsearch, enabling file read, AWS/MailChimp key theft, and full production MySQL access via phpMyAdmin.

- Payout: $5,000
- Severity: critical
- Program: Imgur
- Credited: Nathan
- Disclosed: 2018-07-29
- Write-up quality: 8/10
- Original: https://medium.freecodecamp.org/hacking-imgur-for-fun-and-profit-3b2ec30c9463
- Library page: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:elasticsearch tech:php technique:chained technique:recon technique:source-review vuln:info-disclosure vuln:misconfiguration vuln:rce

**Target:** imgur-dev.com development subdomains (Elasticsearch, phpMyAdmin, PHP app)
**Root cause:** Dev environments were exposed to the public internet via a security group misconfiguration instead of the intended authenticated time-window endpoint; an outdated Elasticsearch enabled dynamic scripting.
**Steps:**
1. Read Imgur HTML source, spot regex referencing `imgur(-dev)?\.com`, infer dev domain `imgur-dev.com`
2. Google `site:imgur-dev.com` finds `alan.imgur-dev.com`; cached copy leaks Kohana profiler SQL tables/columns
3. When live, dev env shows stacktraces, PHP warnings, DB queries, config file paths incl. `keys.php`
4. Run SubBrute on `alan.imgur-dev.com`, find `es.alan.imgur-dev.com` (Elasticsearch)
5. Exploit CVE-2014-3120 dynamic MVEL scripting via `source` param to `_search` to read `/etc/passwd`
6. Read `keys.php` via same file read: Fastly, MailChimp, mobile, reCAPTCHA keys, MySQL creds
7. SubBrute finds `sql.alan.imgur-dev.com` running phpMyAdmin with host selector
8. Log into phpMyAdmin selecting remote AWS MySQL host with leaked creds -> production DB access
**How found:** Familiarity with Imgur plus source-code reading of a referrer regex revealed the internal `imgur-dev.com` domain; Google indexing and subdomain brute-forcing (SubBrute) surfaced live dev hosts, and stacktraces/profiler output pointed to config files worth reading.
**Exploitation:** Chained exposed dev subdomain discovery, Elasticsearch CVE-2014-3120 arbitrary file read, and leaked keys.php credentials to pivot into phpMyAdmin and gain full access to Imgur's production MySQL database; AWS keys were left untested deliberately.
**Escalation:** File read -> config file credential theft -> phpMyAdmin host selection -> production database access; AWS keys present but not used.
**Insight:** Referrer/whitelist regexes in client JS often leak internal dev domains (e.g. `imgur(-dev)?\.com`); pivot to Google `site:` dorks and subdomain brute-force on those dev domains, since dev environments frequently run outdated services and expose config files with prod credentials.