# JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions

Quick Actions /move command serialized the target Project model into the JSON response, leaking any project's runner token to any user who could comment on an issue.

- Payout: $12,000
- Severity: critical
- Program: GitLab
- Credited: jobert
- Disclosed: 2019-04-20
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/509924
- Library page: https://bugbountylibrary.com/r/h1%3A509924
- Tags: domain:web impact:data-leak impact:internal-access impact:privesc kind:bounty platform:hackerone sev:critical tech:rest technique:source-review vuln:access-control vuln:idor vuln:info-disclosure

**Target:** GitLab Quick Actions interpreter on notes endpoint (/:namespace/:project/notes)
**Root cause:** The /move quick action resolved an arbitrary target project without an authorization check, and the resulting Project model was serialized (including runners_token and runners_token_encrypted) into the JSON response.
**Steps:**
1. Create a project and an issue in it
2. Post a comment containing `/move <full path of victim project>` to `/:namespace/:project/notes`
3. Read the JSON response's `commands_changes.target_project` object
4. Extract `runners_token` and `runners_token_encrypted` for the victim project
**How found:** Researcher noticed the /move quick action accepts a project path the user has no access to, and that the API response echoes back the serialized target Project model rather than a minimal reference.
**Exploitation:** Any user able to comment on an issue submits `/move <victim full path>`; the notes endpoint returns the serialized target Project including the runner token. Attacker registers a runner with the stolen token, receives jobs, and reads secret CI/CD variables, potentially deploying arbitrary code to the victim's environment.
**Escalation:** Stolen runner token -> register runner -> intercept CI jobs -> exfiltrate secret project variables -> deploy arbitrary code to victim environment.
**Insight:** Quick Actions that resolve external resources (move/clone/relate) often serialize the full target model into the response; check whether the resolver enforces authorization and whether the serializer exposes sensitive columns like runner tokens.