Ruby on Rails maintainers have disclosed a critical Active Storage vulnerability that can let an unauthenticated attacker write arbitrary files to a server by uploading a crafted file, when the application processes uploads with ImageMagick and its security policy permits the affected coders.
The flaw, tracked as GHSA-f3w6-w445-fwh9 and rated CVSS 9.8, is detailed in the Rails security advisory.
Applications using Active Storage’s Disk service may also be exposed to arbitrary file reads involving files accessible to the Rails process. Those files can include secret_key_base, the application master key, database credentials and third-party service tokens, which could enable further compromise. The vulnerable image analyzer runs when an attachment is added; generating a preview or image variant is not required.
Exposure depends on the application using MiniMagick/ImageMagick, an ImageMagick policy that does not block the relevant coders, and accepting untrusted uploads. The issue is fixed in Active Storage 8.1.4.1 and 8.0.5.2. Rails says one attack chain was reported but does not state that the flaw has been exploited in the wild.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
