# RCE Vulnerabilite in Yahoo Subdomain! ( Yahoo! RCE via Spring Engine SSTI ) By tghawkins

Spring SpEL injection in a Yahoo datax.yahoo.com error page reflected parameter allowed unauthenticated RCE via ${T(java.lang.Runtime)...} payloads.

- Payout: $8,000
- Severity: critical
- Program: Yahoo! / Verizon Media
- Credited: Mohamed Haron
- Disclosed: 2018-01-05
- Write-up quality: 7/10
- Original: https://web.archive.org/web/20200929023045/https://www.mohamedharon.com/2018/01/rce-vulnerabilite-in-yahoo-subdomain.html
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html
- Tags: domain:web impact:rce kind:bounty platform:blog sev:critical tech:java technique:recon technique:source-review vuln:rce vuln:ssti

**Target:** Spring Boot whitelabel error page on datax.yahoo.com API endpoint
**Root cause:** User-controlled parameter reflected into a Spring error page evaluated as a SpEL template, so ${...} expressions execute server-side.
**Steps:**
1. Subdomain recon (shodan, censys, crt.sh, dnsdumpster, massdns) finds datax.yahoo.com redirecting to /swagger-ui.html (403).
2. Dirsearch reveals `https://datax.yahoo.com/%20/` returns 200 instead of 403.
3. Enumerate API endpoints unauthenticated; find one reflecting a parameter in a whitelabel error page.
4. Send `${{7*7}}` and observe `49` in response confirming SpEL evaluation.
5. Confirm env read with `${T(java.lang.System).getenv()}`.
6. Direct `${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}` fails; use ASCII concat via `T(java.lang.Character).toString(...)` and wrap with `T(org.apache.commons.io.IOUtils).toString(...getInputStream())` to read output.
**How found:** Noticed 403→200 status change when appending `%20` to the path, exposing a hidden endpoint; reflection in the error page prompted XSS attempts, then `${{7*7}}` evaluation revealed a template engine, later confirmed as Spring by the vendor.
**Exploitation:** Unauthenticated attacker hits the vulnerable endpoint with a SpEL payload in the reflected parameter; command output is captured via IOUtils.toString on the process InputStream, yielding arbitrary command execution as the app user.
**Insight:** Status-code differentials from path normalization tricks (e.g. `%20`) can expose endpoints hidden behind blanket 403s; when a reflected parameter evaluates `${{7*7}}`, pivot from XSS to SpEL SSTI and use Character.toString concatenation plus IOUtils to bypass exec string filtering and capture output.