# Webshell via File Upload on ecjobs.starbucks.com.cn

Avatar upload on Starbucks China careers site accepted .asp with trailing space, letting attacker upload a webshell and run OS commands on the server.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: johnstone
- Disclosed: 2019-11-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/506646
- Library page: https://bugbountylibrary.com/r/h1%3A506646
- Tags: area:web domain:web impact:data-leak impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical tech:dotnet vuln:command-injection vuln:file-upload vuln:rce

**Target:** ASP.NET resume/avatar upload endpoint on ecjobs.starbucks.com.cn
**Root cause:** Upload filter checks file extension but is bypassed by appending a space after .asp; server (IIS) still executes the file as ASP, and the uploaded script passes a query parameter to a shell command.
**Steps:**
1. Sign in to https://ecjobs.starbucks.com.cn and go to the resume endpoint.
2. Intercept the avatar upload request in Burp.
3. Change filename extension from `.jpg` to `asp ` (trailing space) and set file content to a webshell.
4. Request the uploaded file at `/recruitjob/tempfiles/temp_uploaded_<uuid>.asp?getsc=dir%20d:\TrustHX\STBKSERM101\www_app` to execute commands.
**How found:** Tester noticed the avatar upload accepted dynamic extensions when a trailing space was appended to the extension, bypassing the blacklist.
**Exploitation:** Uploaded ASP webshell executes the `getsc` query parameter as an OS command; attacker ran `dir` to list web root and `type` to read internal C# source files, exposing source code and enabling further internal network access.
**Escalation:** From command execution, read internal source code and potentially pivot into internal network.
**Insight:** When testing upload blacklists on IIS/ASP.NET, try trailing space or dot after the blocked extension (`.asp `, `.aspx.`) — Windows trims these while naive filters compare the raw string.