# Reflected File Download in community.ubnt.com/restapi/

Ubiquiti community REST API reflected a JSONP callback into a .cmd download, letting attackers craft a file that executes commands on the victim's machine.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: a0xnirudh
- Disclosed: 2017-05-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/107960
- Library page: https://bugbountylibrary.com/r/h1%3A107960
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:high technique:source-review vuln:misconfiguration vuln:rce

**Target:** REST API JSONP endpoint (community.ubnt.com/restapi)
**Root cause:** The restapi endpoint reflects the user-supplied callback parameter unsanitized into a response served with a .cmd filename, allowing arbitrary command content to be embedded in a downloadable batch file.
**Steps:**
1. Craft URL `https://community.ubnt.com/restapi/vc/authentication/sessions/Ubiquiti_update.cmd?restapi.response_format=json&callback=\%22||calc||`
2. Embed in an HTML5 anchor with `download='ubiquiti_update.cmd'` on any page
3. Victim clicks link; browser downloads a .cmd file named ubiquiti_update.cmd attributed to community.ubnt.com
4. Victim opens the file; embedded `||calc||` command executes
**How found:** Researcher noticed the JSONP callback parameter was reflected into a response served as a .cmd file, enabling RFD.
**Exploitation:** Attacker hosts a page with the download anchor; victim clicks, receives a .cmd file whose content includes attacker-controlled commands via the reflected callback, and executing it runs arbitrary commands on the victim's Windows machine.
**Escalation:** Arbitrary commands can be placed in the file for full victim machine compromise.
**Insight:** JSONP callback reflection combined with a filename/extension the server controls (e.g. .cmd) yields RFD; test callback params for reflected content and check Content-Disposition/filename behavior.