Critical Rails Active Storage Flaw Could Allow Arbitrary File Access
Summary
A critical Rails Active Storage flaw involving ImageMagick can let unauthenticated attackers write arbitrary files and, in some configurations, read files. Patches and workarounds are available; exposed secrets should be rotated.
Key points
- GHSA-f3w6-w445-fwh9 affects Active Storage versions before 8.0.5.2 in the 8.0 series and before 8.1.4.1 in the 8.1 series.
- The flaw can affect Rails applications that process attachments with ImageMagick, accept untrusted uploads, and lack a policy blocking the affected coders.
- An unauthenticated attacker may write arbitrary files; applications using the Disk service may also allow reading files accessible to the application process.
- The issue arises because ImageMagick may select a coder based on file contents rather than the uploaded file's name or extension.
- Patches are available, and the advisory provides mitigation requirements for MiniMagick and ImageMagick users, including system-policy workarounds.
- For potentially exposed Disk-service applications, the advisory recommends changing secret_key_base and other secrets readable by the application, without retaining exposed secrets as fallbacks.
- WatchTowr said it reproduced the vulnerability in a lab; its representative expected public proof-of-concept code could emerge within days. The article does not report exploitation in the wild.
Article Details
- Vulnerability Types
- Arbitrary file write
- Arbitrary file read
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- Active Storage 8.0 versions before 8.0.5.2
- Active Storage 8.1 versions before 8.1.4.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply the system rules provided on the GitHub page to ImageMagick's system policy.
MITRE ATT&CK
T1005 · Data from Local SystemWhen attachments use the Disk service, the vulnerability can allow reading arbitrary files accessible to the application process.T1190 · Exploit Public-Facing ApplicationThe vulnerability allows an unauthenticated attacker to submit a crafted image to a Rails application using Active Storage and ImageMagick.