Rails Patches Critical Flaw Enabling Arbitrary Server File Writes
A flaw in Active Storage, the Ruby on Rails component that handles file uploads, allows an unauthenticated attacker to write arbitrary files on the server by uploading a crafted file when the app processes uploads with ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. Affected apps should update.
What happened
The Rails project fixed a critical flaw in Active Storage, the component that handles file uploads. An unauthenticated attacker could write arbitrary files on the server by uploading a crafted file, in apps that process uploads with ImageMagick. The fix shipped in versions 8.1.4.1 and 8.0.5.2.
Why it matters
Arbitrary file writes on the server can compromise the entire application. Any company running a Rails app that processes uploads with ImageMagick is exposed, and the attacker needs no login.
What to do
Update Rails to 8.1.4.1 or 8.0.5.2 now. Identify which applications use Active Storage with ImageMagick and prioritize their update.
For the technical team
- Affected
- Ruby on Rails (Active Storage) · Ruby on Rails applications that process uploads with ImageMagick (via Active Storage).
- Exploitation
- No exploitation reported in the sources. Flaw disclosed in an advisory by the Rails project, covered by The Hacker News.
- Fix
- Update to Rails 8.1.4.1 or 8.0.5.2.
- Vector
- Flaw in Active Storage, the Ruby on Rails file upload component. An unauthenticated attacker uploads a crafted file; arbitrary file writes occur if the app processes uploads with ImageMagick.
- More details
- The Rails project advisory is the disclosure origin. No CVE cited in the sources.
Timeline
Rails project advisory discloses the flaw and releases fixed versions 8.1.4.1 and 8.0.5.2.
Sources 1 source
- Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Hacker News
