# Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300

In AirOS 6.1.5, missing validation lets an attacker bypass CSRF, plant stored XSS, fully defeat CSRF tokens, and reach command injection on PowerBeam M5 300.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: maxpl0it
- Disclosed: 2018-06-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/289264
- Library page: https://bugbountylibrary.com/r/h1%3A289264
- Tags: area:devices domain:iot impact:integrity impact:rce kind:bounty platform:hackerone sev:high technique:chained vuln:command-injection vuln:csrf vuln:rce vuln:xss

**Target:** AirOS web management interface on PowerBeam M5 300
**Root cause:** Lack of validation on certain web pages allows CSRF bypass; stored XSS then defeats the form CSRF token scheme entirely, exposing a command injection sink.
**Steps:**
1. Lure an authenticated admin to an attacker-controlled page to trigger CSRF against a vulnerable AirOS 6.1.5 endpoint.
2. CSRF request modifies device configuration and plants stored XSS.
3. Stored XSS executes in admin context, bypassing CSRF tokens completely.
4. Use the XSS to reach the command injection sink and execute commands.
**Exploitation:** Chain of four bugs: CSRF (via missing validation) modifies config and stores XSS; the XSS runs in the authenticated admin's browser, fully bypassing CSRF tokens, and is used to trigger command injection on the device.
**Escalation:** CSRF -> stored XSS -> full CSRF bypass -> command injection/RCE.
**Insight:** Stored XSS in an admin panel can neutralize CSRF token defenses entirely, turning a config-write CSRF into a reliable path to command injection sinks.