# [hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/import

Authenticated user uploads a SCORM package containing an ASPX webshell; the importer extracts it into a web-served directory, yielding remote command execution.

- Payout: hidden
- Severity: critical
- Program: U.S. Dept Of Defense
- Found by: cdl
- Disclosed: 2022-09-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1122791
- Library page: https://bugbountylibrary.com/r/h1%3A1122791
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical tech:dotnet technique:source-review vuln:access-control vuln:file-upload vuln:rce

**Target:** ASP.NET SCORM course upload/import endpoint (scorm2004uploadcourse.aspx)
**Root cause:** The SCORM upload/import endpoint lacks access control and extracts attacker-supplied archive contents (including .aspx files) into a web-accessible Courseware directory without filtering executable extensions.
**Steps:**
1. Log in to https://███/ with provided credentials
2. Build a valid SCORM zip containing `shared/cdlcdlcdl.aspx` (runs `whoami`) and reference it in `imsmanifest.xml`
3. POST the zip to `/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004uploadcourse.aspx`
4. Intercept the follow-up request to `scorm2004editmetadata.aspx` and read the response to extract `strCourseId` (e.g. `F6BAC72B45D64B34ACB662BB001D8523`)
5. Request `https://███/CServer/Courseware/<COURSE_ID>/shared/cdlcdlcdl.aspx` to execute the shell
**How found:** Researcher noticed the SCORM upload/import endpoint was reachable and that uploaded packages are extracted server-side; hypothesized that archive contents land in a web-served directory, then embedded an ASPX file referenced in imsmanifest.xml to test execution.
**Exploitation:** Upload a crafted SCORM package via the unauthenticated/improperly-controlled upload endpoint; the server extracts the archive into a predictable Courseware/<courseId>/ path, and the embedded ASPX file is then requested directly to execute arbitrary commands as the web server.
**Insight:** SCORM/e-learning importers unzip packages into web-served paths; always test whether archive members with server-executable extensions (.aspx/.php/.jsp) survive extraction and are reachable under a predictable course ID.