# RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/

Chained Tomcat mod_proxy traversal and unauthenticated JBoss web console to reach RCE and full server compromise on a Starbucks Singapore subdomain.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: spaceraccoon
- Disclosed: 2019-04-10
- CVE: CVE-2007-0450, CVE-2007-1036
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/502758
- Library page: https://bugbountylibrary.com/r/h1%3A502758
- Tags: area:web domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:critical tech:java technique:chained technique:recon vuln:auth-bypass vuln:deserialization vuln:path-traversal vuln:rce

**Target:** Apache Tomcat mod_proxy fronting JBoss web console
**Root cause:** Old Tomcat 5.5.20 mod_proxy mishandles encoded backslash traversal (`%5C../`), letting requests escape the proxy to localhost; the JBoss web console behind it was unauthenticated and deserialization-vulnerable.
**Steps:**
1. Enumerate subdomains, find 404 page; footer reveals obscure custom CMS name
2. Request `site.com/<cmsname>` to get redirected to `/josso/signin` login form
3. Trigger Tomcat stack trace to fingerprint version 5.5.20
4. Send `site.com/josso/%5C../` to bypass mod_proxy and reach JBoss web console on localhost
5. Run jexboss against `/josso/%5C../web-console` to exploit Java deserialization for RCE
**How found:** 404 page footer disclosed an old obscure custom CMS; guessing the CMS name as a URL path revealed a hidden login app, and path fuzzing produced a Tomcat stack trace exposing the vulnerable version.
**Exploitation:** Traversal payload `%5C../` in the path escaped the Apache proxy to the internal JBoss web console, which lacked authentication; jexboss deserialization payloads sent to `/josso/%5C../web-console` yielded command execution, allowing page modification, internal host enumeration, and reading a backup SQL dump.
**Escalation:** Post-RCE pivoted to internal network reconnaissance and exfiltrated a backup SQL dump.
**Insight:** When a dead subdomain's footer names an obscure CMS, try the CMS name as a URL path to reveal hidden apps; then fuzz encoded traversal sequences like `%5C../` to test whether a fronting proxy can be escaped to internal admin consoles.