Critical Ruby on Rails Active Storage flaw lets attackers access server files via crafted image uploads
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
Rails Active Storage passes uploads to ImageMagick, which chooses its file handler based on file contents and can act on other files named inside an image. Unauthenticated users can trigger file writes, and file reads where the Disk service is used, by attaching a crafted upload, with a CVSS score of 9.8. Fixed releases are activestorage 8.0.5.2 and 8.1.4.1, and the fix ships an ImageMagick policy that blocks the risky coders.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Upgrade activestorage to 8.0.5.2 or 8.1.4.1 and, if using :minimagick, upgrade minimagick to 5.1 or newer.
- If the app uses the Disk service, change secretkeybase and every other secret the app process can read.
- If patching cannot happen immediately, copy the shipped ImageMagick policy rules into the system policy.xml, at minimum blocking the MSL coder, the Ghostscript coders and the gs delegate.
- Review logs for unusual uploads and check that no app runs with extra file permissions.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News