Critical Rails Active Storage Flaw Allows File Writes via ImageMagick Uploads

Summary

Rails disclosed critical Active Storage flaws that can expose apps processing uploads with ImageMagick to unauthenticated file writes and reads. Fixed releases are 8.1.4.1 and 8.0.5.2; exploitation status is unspecified.

Key points

A crafted upload can trigger unauthenticated arbitrary file writes in affected Rails apps using Active Storage with ImageMagick.
Apps using Active Storage's Disk service may also be exposed to arbitrary file reads; access to secrets could potentially enable remote code execution or lateral movement.
The reported attack path uses an SVG file to reach ImageMagick's MSL coder, which can read and write files named in its script.
Rails rates the flaw 9.8 and tracks it as GHSA-f3w6-w445-fwh9; it has no CVE identifier.
Fixed versions are Rails 8.1.4.1 and 8.0.5.2. Older release series before 8.0 are unsupported and will not receive fixes.
Rails said one attack chain was reported but did not say whether the flaw has been exploited; the advisory also does not explain how to check for prior targeting.
The same releases fix another Active Storage flaw, GHSA-v924-7rp8-4mxh, rated 8.8, and add an ImageMagick policy that blocks risky coders and file operations.

Article Details

Vulnerability Types: Arbitrary server-side file write
Arbitrary file read
Severity: Critical; CVSS 9.8/10
Affected Versions: Active Storage versions before 8.0.5.2
Active Storage 8.1 versions before 8.1.4.1
Exploitation Status: unknown
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker can exploit the flaw by uploading a crafted file to an affected Rails application that processes uploads with ImageMagick.

People

RyotaKReported the vulnerability through HackerOne; the article identifies RyotaK as a researcher at GMO Flatt Security.

Products

FFmpegwhich Rails rates high with a CVSS score of 8.8. Active Storage passed uploads to ImageMagick and FFmpeg under temporary file names that kept the uploaded file's extension.Ghostscriptimage; coders that fetch remote or local references or display them on a screen; every coder backed by Ghostscript, along with the gs delegate; and @filename indirection.ImageMagickarbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.