Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
A file masquerading as an image can force a web server to write data to a location chosen by the attacker. Ruby on Rails developers have patched a critical bug in Active Storage, a component for uploading attachments. The attacker does not need a user account if the application accepts files from external users and processes them with ImageMagick.
The Rails team made the issue public on November 4 with identifier GHSA-f3w6-w445-fwh9. The vulnerability received a critical rating of 9.8 points according to CVSS 3.0, but a CVE number has not yet been assigned. In certain configurations, Active Storage allows writing files to arbitrary locations and, when attachments are stored locally, also reading data accessible to the application.
The cause is linked to ImageMagick format handlers. The library determines the handler based on the file’s content, and some handlers can work with other files on disk. Active Storage did not restrict the choice. A specially crafted SVG file could trigger the MSL script handler, which can read and write files via embedded instructions.
The dangerous mechanism is triggered already during attachment upload. The site does not need to create a thumbnail, a preview, or analyze the image separately. Applications that accept files from untrusted users, use MiniMagick, and do not block dangerous formats in the ImageMagick policy are at risk. The default settings of Debian and Ubuntu do not enforce such a block.
When attachments are stored via Active Storage Disk, the attacker can read files accessible to the application process. Possible targets include secret_key_base, encryption keys, database passwords, and external service tokens. Compromise of secrets can pave the way to remote code execution or access to connected systems.
The bug affects Active Storage up to version 8.0.5.2 and the 8.1 branch up to 8.1.4.1. With load_defaults 6.1 and earlier versions, MiniMagick is used by default, whereas starting with load_defaults 7.0 libvips is typically used. This summer another Active Storage vulnerability involving libvips has already begun to be exploited on real servers. There are no confirmed attacks exploiting the new flaw yet.
The fixes have been included in Rails 8.0.5.2 and 8.1.4.1. Developers added a security policy that blocks MSL, other dangerous handlers, and calls to Ghostscript. For the protection to work, mini_magick 5.1 or later is required. Older Rails branches are not supported, so applications must be upgraded or the rules must be manually transferred to the ImageMagick system configuration.
In the new Rails releases, a total of 21 security issues have been fixed. Developers also recommend rotating secret_key_base, the master key, passwords, and tokens if the application used Disk storage and could be vulnerable. Installing the update does not secure previously exposed secrets. Information about real-world attacks via GHSA-f3w6-w445-fwh9 is not included in the advisory.
