Critical Ruby on Rails Flaw Lets Attackers Write Files to Servers Through Image Uploads

The Rails project has disclosed a critical flaw in Active Storage, the part of Rails that handles file uploads. An unauthenticated attacker could write arbitrary files on an app's server by uploading a crafted file, if the app processes uploads with ImageMagick. Rails rates the flaw 9.8 out of 10 on the CVSS scale. It is tracked as GHSA-f3w6-w445-fwh9 and does not yet have a CVE identifier. Fixes are available in versions 8.1.4.1 and 8.0.5.2.

In apps that use Active Storage's Disk service, which keeps uploads on the server's disk, an attacker could also read any file the app can read. Rails says those files typically include the app's secret_key_base and credentials for other systems, which could lead to remote code execution or lateral movement. The flaw is reached simply by attaching an upload; the app does not need to create a variant or preview. Rails says one attack chain was reported but does not assume it is the only one. The advisory does not say whether the flaw has been exploited. It was reported through HackerOne by RyotaK of GMO Flatt Security.

Every Active Storage version before 8.0.5.2 is affected, as are 8.1 versions before 8.1.4.1. Release series older than 8.0 are unsupported, and Rails will not issue fixes for them. To check whether ImageMagick is in use, look at config.active_storage.variant_processor. If it is not set, the default depends on load_defaults: :mini_magick before 7.0, and :vips from 7.0 on.