# RCE on facebooksearch.algolia.com

Leaked Rails secret_key_base in a public GitHub repo let an attacker forge a signed CookieStore session containing a deserialized Ruby gadget, achieving RCE on facebooksearch.algolia.com.

- Payout: $500
- Severity: critical
- Program: Algolia
- Credited: michiel
- Disclosed: 2016-10-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/134321
- Library page: https://bugbountylibrary.com/r/h1%3A134321
- Tags: domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:ruby technique:recon technique:source-review vuln:deserialization vuln:rce vuln:secrets-leak

**Target:** Rails web app (facebooksearch.algolia.com) CookieStore session
**Root cause:** Rails secret_key_base committed to a public GitHub repo; CookieStore deserializes signed cookie data server-side, so a known secret allows forging a cookie with a malicious Ruby object that executes code on unmarshal.
**Steps:**
1. Scan Algolia public/employee GitHub repos with Gitrob; find `config/initializers/secret_token.rb` containing secret_key_base in commit f3adccb
2. Extract the secret from the public commit
3. Use Metasploit `exploit/multi/http/rails_secret_deserialization` with `set secret <leaked>`, `set rhost facebooksearch.algolia.com`, `set railsversion 4`, `set targeturi /auth/facebook`
4. Patch cookie regex to allow `-` in cookie name `_facebook-search_session`
5. Run exploit; forged signed cookie deserializes to Ruby gadget executing commands, reverse shell established
6. Verify with `id` and by writing `/hackerone.txt`
**How found:** Recon on Algolia's public GitHub repos and employee repos using Gitrob surfaced a `secret_token.rb` initializer; recognizing it holds secret_key_base and that the app uses CookieStore led to the deserialization RCE hypothesis.
**Exploitation:** Attacker forges a signed `_facebook-search_session` cookie embedding a Ruby deserialization gadget; server unmarshals it and executes arbitrary code, yielding a reverse shell as user prod and arbitrary file write on the host.
**Insight:** Scan org and employee public GitHub repos for framework initializer files (secret_token.rb, credentials, .env) — a leaked Rails secret_key_base plus CookieStore is a direct deserialization RCE; check cookie names with hyphens when adapting existing exploits.