Critical Ruby on Rails Active Storage flaw lets attackers access server files via crafted image uploads
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A serious flaw in the Ruby on Rails web framework lets anyone who can upload files plant or read files on the server by sending a specially crafted image. Attackers could use this to steal the secret keys that protect the application.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Upgrade activestorage to 8.0.5.2 or 8.1.4.1 and, if using :minimagick, upgrade minimagick to 5.1 or newer.
- If the app uses the Disk service, change secretkeybase and every other secret the app process can read.
- If patching cannot happen immediately, copy the shipped ImageMagick policy rules into the system policy.xml, at minimum blocking the MSL coder, the Ghostscript coders and the gs delegate.
- Review logs for unusual uploads and check that no app runs with extra file permissions.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News