Rails Patches Critical 9.8 Active Storage Flaw Linked to ImageMagick File Handling
Cybersecurity and privacy
Ruby on Rails released security updates 8.0.5.2 and 8.1.4.1 to address a critical CVSS 9.8 Active Storage vulnerability. Applications using Active Storage with ImageMagick to handle uploads under certain settings could allow unauthenticated attackers to write or read arbitrary server files. Rails added safeguards and advised patching and credential rotation.
Open-source web framework Ruby on Rails released versions 8.0.5.2 and 8.1.4.1 on November 4, addressing 21 security issues. Among them is a critical vulnerability in Active Storage with a CVSS score of 9.8. Applications processing file uploads via Active Storage and ImageMagick without appropriate security policies may allow unauthenticated attackers to write arbitrary files upon upload analysis; configurations using Disk storage may also allow arbitrary file reads. Such reads could expose secrets or credentials, posing risks of remote code execution or lateral movement. Rails introduced safety restrictions, urging administrators to update and rotate credentials. Security firm watchTowr reportedly reproduced the flaw in a lab environment.
Key takeaways
- Rails issued versions 8.0.5.2 and 8.1.4.1 fixing 21 issues, including a CVSS 9.8 Active Storage vulnerability.
- The flaw affects applications using Active Storage and ImageMagick, allowing unauthenticated file writes and arbitrary file reads under specific setups.
- Unauthorized access to application secrets or credentials could enable remote code execution and lateral movement.
- Recommendations include upgrading Rails, ensuring MiniMagick is at version 5.1+, and rotating application credentials if using Disk storage.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.