Critical Ruby on Rails flaw lets attackers write server files via crafted ImageMagick uploads
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A critical unauthenticated arbitrary file write flaw in Ruby on Rails Active Storage affects apps that process uploads with ImageMagick, allowing a crafted file to write files to the server. The Rails project disclosed it in an advisory and fixed it in 8.1.4.1 and 8.0.5.2. The source excerpt gives no CVE ID. Defenders should upgrade to a fixed release, and check whether any Rails app uses Active Storage with ImageMagick for uploads.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Upgrade Ruby on Rails to version 8.1.4.1 or 8.0.5.2, depending on the release branch in use.
- Check whether any application processes uploads through Active Storage with ImageMagick.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Products