# Phabricator Phame Blog Skins Local File Inclusion

Phame blog skin parameter accepted path traversal, letting an attacker with file-write access load a malicious skin from /tmp and execute PHP for RCE.

- Payout: $500
- Severity: high
- Program: Phabricator
- Credited: nullsub
- Disclosed: 2015-01-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/39428
- Library page: https://bugbountylibrary.com/r/h1%3A39428
- Tags: domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:high tech:php technique:chained vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Phame blog skin selection endpoint (/phame/blog/new/)
**Root cause:** The `skin` parameter is used to build a filesystem path to skin template files without validating it stays within the skins root, so `../` sequences traverse to arbitrary directories.
**Steps:**
1. Upload a valid skin directory structure (header.php etc.) to a writable path such as `/tmp/test/`, with PHP code in header.php
2. Send `POST /phame/blog/new/` with `skin=../../../../../../../../../../tmp/test` (URL-encoded)
3. Phabricator resolves the skin path to `/var/www/phabricator/phabricator/externals/skins/../../../../../../../../../../tmp/test/`
4. Visit the blog page; the attacker-controlled header.php executes, achieving RCE
**How found:** Researcher noticed the blog skin setting is a user-controlled path used to load template files, hypothesized directory traversal, and tested by pointing skin at /tmp/test containing a copied skin with phpinfo() in header.php.
**Exploitation:** Precondition: attacker can write files to a server path (e.g. /tmp via restricted SSH or another upload feature). Attacker plants a skin directory with a PHP payload in header.php, then creates a Phame blog pointing `skin` at that directory via path traversal. Rendering the blog includes the attacker's PHP, executing code as the web server user and exposing Phabricator data.
**Insight:** When a user-selectable 'theme/skin/template' name is concatenated into a filesystem include path, test traversal to any writable dir (e.g. /tmp) and combine with any file-write primitive to turn LFI into RCE.