# Remote Code Execution in Basecamp Windows Electron App

Basecamp Electron app's internal-domain regex bypassed via attacker-controlled subdomain, serving text/calendar to auto-execute a downloaded .exe on click.

- Payout: hidden
- Severity: high
- Program: Basecamp
- Found by: co0sin
- Disclosed: 2020-11-19
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1016966
- Library page: https://bugbountylibrary.com/r/h1%3A1016966
- Tags: area:os domain:desktop impact:ato impact:rce kind:bounty platform:hackerone sev:high tech:electron technique:source-review vuln:rce

**Target:** Basecamp Windows Electron desktop app download/attachment handler
**Root cause:** Internal-domain check uses unanchored regex matching substrings, so an attacker subdomain like launchpad.dev.attacker.com passes; combined with text/calendar mime auto-open, downloaded files execute.
**Steps:**
1. Register subdomain starting with `launchpad.dev.` (e.g. `launchpad.dev.attacker.com`).
2. Serve `file.exe` with `Content-Type: text/calendar` and `Content-Disposition: attachment` via Flask.
3. Post link `http://launchpad.dev.attacker.com/file.exe?attachment=true` in a Basecamp post.
4. Victim clicks link in desktop app; file downloads and auto-executes.
**How found:** Reading Electron source revealed `OPENABLE_MIME_TYPES = new Set(["text/calendar"])` and the internal-domain regexes; noticed the regexes are unanchored and match attacker-controlled subdomains.
**Exploitation:** Attacker posts a link to their subdomain serving an .exe as text/calendar; the Electron app treats it as internal and openable, downloads and executes it when the victim clicks.
**Insight:** Unanchored domain regexes like `launchpad\.37signals\.com` match `launchpad.37signals.com.attacker.com`; always test internal-allowlist regexes with attacker-controlled subdomains and suffixes.