Covered by 2 outlets — first reported by The Hacker News, Nov 4, 12:07 UTC
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
In brief
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store
From The Hacker News's coverage.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick.
Dark Reading
Critical Rails Bug Threatens to Derail Vulnerable Servers
An attacker could write arbitrary files and read sensitive files via images uploaded to the Rails Active Storage ImageMagick integration, possibly positioning a threat actor for lateral movement.