SecOraLens
CriticalCVE

Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

The Hacker News·Source published ·1 min read

What happened?

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads.

Key details

  • A critical flaw in Rails Active Storage lets unauthenticated attackers write arbitrary server files via crafted ImageMagick uploads.
  • The vulnerability resides in Active Storage's Disk service which stores uploads on the server disk and can also expose readable files.
  • ImageMagick's MSL coder is reachable through Active Storage's analyzer when an SVG upload is processed.
  • The flaw is rated 9.8 CVSS and tracked as GHSA-f3w6-w445-fwh9 without a CVE identifier yet.
  • Rails disclosed the flaw and fixed it in versions 8.1.4.1 and 8.0.5.2, which also address 21 total security issues.

Affected

  • All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected.
  • Apps using ImageMagick via config.active_storage.variant_processor = :mini_magick (default on load_defaults 6.1 or earlier).
  • Apps whose ImageMagick policy does not block the involved coders (Debian/Ubuntu default policies do not).
  • Apps accepting file uploads from untrusted users.
  • Release series older than 8.0 are unsupported and will not receive fixed versions.

Fixes and mitigations

  1. Upgrade to Rails 8.1.4.1 or 8.0.5.2; also require mini_magick 5.1 or later for :mini_magick apps.
  2. Shipped ImageMagick policy blocks MSL coder, file-reading coders, remote reference coders, Ghostscript coders, gs delegate, and @filename indirection.
  3. At minimum, block MSL coder, Ghostscript coders, and gs delegate in system policy.
  4. Patches for 8.1 and 8.0 are also published; older series can use workaround or upgrade to 8.0+.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories