# reverb.twitter.com redirects to vulnerable reverb.guru

reverb.twitter.com redirected to reverb.guru, whose PHP image-upload endpoint preserved extensions and allowed a JPEG-polyglot webshell to survive resizing, yielding RCE.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: theraz0r
- Disclosed: 2016-10-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/158148
- Library page: https://bugbountylibrary.com/r/h1%3A158148
- Tags: area:web domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:php technique:chained vuln:file-upload vuln:rce

**Target:** PHP image upload endpoint /api/actions/fileUpload.php on reverb.guru
**Root cause:** Upload endpoint preserved the original file extension and only resized images to 50x50, so a crafted JPEG with embedded PHP payload survived the resize and was saved as .php.
**Steps:**
1. Intercept requests to discover `http://reverb.guru/api/actions/fileUpload.php`, which accepts `image_file` uploads with a valid Twitter auth.
2. Upload a normal image; response returns `{"image_path":"\/view\/data\/logos\/test_3922005924.jpg"}` showing extension preserved.
3. Note the server crops to 50x50 and strips naive payloads; determine resize quality (75%) from uploaded image metadata.
4. Generate a 50x50 JPEG at 75% quality with an embedded PHP webshell using the Nasty-bulletproof-Jpegs PoC.
5. Upload the crafted JPEG, then rename/upload with `.php` extension so the shell survives at `/view/data/logos/test_4992504809.php`.
6. Execute commands via `?c=id`.
**How found:** Analyzed intercepted HTTP requests to discover the fileUpload.php endpoint, then observed the server resized uploads and preserved extensions; deduced resize quality from image metadata to craft a payload that survives resizing.
**Exploitation:** Attacker with a valid Twitter auth uploads a JPEG polyglot containing PHP code; the server resizes to 50x50 at 75% quality but preserves the embedded payload and the .php extension, allowing webshell execution. Since reverb.twitter.com redirects to reverb.guru, the attacker could modify site content to redirect to phishing or force malicious downloads.
**Escalation:** Chained a trusted twitter.com subdomain redirect with RCE on the third-party destination to lend credibility to phishing/malware delivery.
**Insight:** When an upload endpoint resizes images, don't assume payloads are stripped—determine the exact resize/compression parameters (often leaked in image metadata) and craft a polyglot that survives that specific transformation, then abuse preserved extensions.