# information disclosure of secret_key_base via encoding charcters

Fuzzing an encoding character on customers.gitlab.com triggered a Rails error page leaking secret_key_base, letting unauthenticated attackers forge/decrypt signed cookies.

- Payout: $3,500
- Severity: high
- Program: GitLab
- Credited: paresh_parmar
- Disclosed: 2019-06-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/460545
- Library page: https://bugbountylibrary.com/r/h1%3A460545
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing technique:source-review vuln:info-disclosure vuln:misconfiguration

**Target:** customers.gitlab.com Rails web application error page
**Root cause:** An unhandled exception from a malformed encoding character rendered a verbose Rails error page that included the application's secret_key_base in the environment/config dump.
**Steps:**
1. Fuzz a request parameter with various encoding characters.
2. Send a character that triggers an unhandled exception (e.g. malformed encoding).
3. Observe the Rails error page disclosing `secret_key_base`.
4. Use the leaked key to decrypt/forge signed cookies (serializer was `:json`, so no RCE).
**How found:** Researcher was fuzzing a parameter with different encoding types; one character produced an error page that dumped the Rails secret token.
**Exploitation:** Unauthenticated attacker triggers an error page to obtain secret_key_base, then uses it to decrypt signed cookies and potentially forge them depending on app logic; RCE via Marshal deserialization was blocked because cookies_serializer was :json.
**Insight:** When fuzzing encodings, watch for verbose Rails error pages that dump ENV/config — secret_key_base leaks there; check cookies_serializer to know if it escalates to RCE (Marshal) vs cookie forgery (json).