# Forged token deserialization RCE

Hardcoded or leaked signing secrets and unsafe deserialization of signed cookies, tokens, or session files

_Area: Web injection and code execution. Seen in 2 disclosed reports; one confirmed bounty: $2,500; latest 2025-07-10. Updated 2026-10-24._

## How it works
A signed token or session file is trusted because it carries a valid signature. That trust assumes the signing secret is private and the payload is only ever data. When the secret is hardcoded, shipped in an open-source component, or leaked, an attacker can mint their own valid token. If the backend then deserializes that payload into objects (Rails 3.x cookies, Lua session files, typed JSON parameters), the attacker's data becomes code. The broken assumption is that a valid signature means a trusted payload; in reality it only means someone with the secret wrote it.

## Where it shows up
- Hardcoded `secret_token`/`secret_key_base` or similar constants in vendored or open-source admin apps [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md)
- Session cookies or files that are deserialized rather than parsed as plain data [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md)
- User-controlled fields (even a username) written into serialized session objects [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md)
- Endpoints accepting typed parameters that instantiate classes (JSON web services) [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Secrets in readable config files, with over-broad cloud permissions behind them [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md)

## How to review
Check the exact property: no signing secret is static or public, and no signed payload is ever deserialized into live objects. Trace every cookie/token/session file from input to sink. Confirm the secret is generated per deployment and rotated, and that session data is parsed as inert data (allowlisted types, no object instantiation). For any endpoint taking typed parameters, verify a class allowlist exists [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md). For session files, verify input is sanitized before serialization and null bytes cannot truncate validation [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md).

## Variants seen
- Hardcoded Rails secret enabling forged-cookie deserialization RCE [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md)
- Typed-parameter instantiation in a JSON web service reached past a WAF [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Null-byte injection into a Lua session file later deserialized [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md)

## Why fixes fail
E1 shows the secret was static in a shipped component, so every install shared it; rotating one deployment does not fix the class. E2 shows WAF/backend decoding disagreement defeating a perimeter control, so the sink must be fixed, not the filter.

## Impact and severity
Full server compromise leading to cloud key theft and bucket access [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md), pre-auth RCE [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md), root/SYSTEM RCE exploited in the wild within a day of disclosure [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md). Severity is high; it worsens with excessive cloud permissions [E1](https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md) and with perimeter-only defenses [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aexfiltrated-com-research-instagram-rce-php.md
- E2: https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild.md