Critical Ruby on Rails flaw lets attackers write server files via crafted ImageMagick uploads
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A critical unauthenticated file-write flaw affects Ruby on Rails apps that process uploads through Active Storage with ImageMagick. A crafted upload can write arbitrary files on the server. The Rails project has fixed it in versions 8.1.4.1 and 8.0.5.2.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Upgrade Ruby on Rails to version 8.1.4.1 or 8.0.5.2, depending on the release branch in use.
- Check whether any application processes uploads through Active Storage with ImageMagick.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Products