# H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products

Kit CRM accepted unvalidated image uploads; a Postscript ImageTragick payload executed via ImageMagick/Ghostscript, yielding a reverse shell and AWS metadata credentials.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: fransrosen
- Disclosed: 2020-02-06
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/422944
- Library page: https://bugbountylibrary.com/r/h1%3A422944
- Tags: area:web domain:web impact:data-leak impact:internal-access impact:rce kind:bounty platform:hackerone sev:medium tech:aws technique:chained vuln:file-upload vuln:rce

**Target:** Image upload endpoint (bulk customer update / priority product images) on kitcrm.com
**Root cause:** Kit did not validate uploaded image file types, and its ImageMagick install left Ghostscript enabled, so a Postscript file was processed and executed.
**Steps:**
1. Upload a file to https://kitcrm.com/seller/onboarding/1 containing the ImageTragick Postscript payload with `%pipe%python -c '...socket...connect...'` to a netcat listener.
2. Connect kitcrm to Facebook Messenger and send commands to kit to trigger processing of the uploaded priority product image.
3. Receive reverse shell as user `deploy` on the host.
4. Run `curl http://169.254.169.254/latest/meta-data/iam/security-credentials/` to retrieve AWS IAM credentials.
**How found:** Noticed the upload endpoint did not verify that images were real JPG/PNG/GIF, hypothesized ImageMagick would process arbitrary formats, and applied the known ImageTragick Postscript payload.
**Exploitation:** Attacker uploads a malicious Postscript file as a priority product image, then triggers Kit's image processing via Messenger interaction, spawning a reverse shell; from there reads AWS instance metadata to obtain IAM access keys and token.
**Escalation:** Pivoted from RCE to AWS metadata credential theft (AccessKeyId/SecretAccessKey/Token) and attempted S3 enumeration.
**Insight:** When an upload endpoint skips content-type/magic-byte validation, test known ImageMagick delegate exploits (Postscript/MSL/SVG) rather than just polyglots; also check whether the processing pipeline runs on cloud instances with reachable IMDS.