Skip to content
securitytabs

LiveUpdated

Rails fixes critical file-write flaw in Active Storage uploads

A flaw in Ruby on Rails, a popular web framework, could let an outsider write files onto a website's server through a crafted upload. Sites that process uploads with ImageMagick should install the fixed Rails versions.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

The Rails project disclosed a critical flaw in Active Storage, the part of Rails that handles file uploads, and fixed it in versions 8.1.4.1 and 8.0.5.2. The Hacker News reports that an unauthenticated attacker could write arbitrary files on a server by uploading a crafted file if the app processes uploads with ImageMagick. [1]

Dark Reading reports that an attacker could also read sensitive files, which could position a threat actor for lateral movement. Socket says that under certain configurations this could lead to remote code execution, and that the Rails release addressed 21 vulnerabilities in total. [2][3]

What is not yet known

The cited coverage does not say that the flaw is being exploited, and no CVE identifier appears in the sources reviewed. Socket describes a free certified patch for the flaw. [3][1]

Timeline

  1. Socket published a certified patch for the Active Storage flaw. [3]

  2. The flaw was described as also allowing reads of sensitive files through the ImageMagick integration. [2]

  3. The Rails project disclosed the Active Storage flaw and released fixed versions 8.1.4.1 and 8.0.5.2. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your website or app was built with Ruby on Rails and accepts uploads, it may be affected. [1]

What to do

  1. Ask your developer or hosting provider whether the app uses Rails Active Storage with ImageMagick. [1]
  2. Ask them to update to Rails 8.1.4.1 or 8.0.5.2. [1]

Mid-size company

A small IT or security team

What to know

Apps that process uploads with ImageMagick through Active Storage are exposed to arbitrary file writes by unauthenticated users. [1][2]

What to do

  1. Inventory Rails applications and upgrade to 8.1.4.1 or 8.0.5.2. [1]
  2. Review which applications use ImageMagick for upload processing. [1]

Large enterprise

A security operations team

What to know

The Rails release fixed 21 vulnerabilities, including the critical Active Storage flaw, which Socket says could lead to remote code execution under some configurations. [3]

What to do

  1. Identify Rails services across the estate and prioritise those that accept uploads processed by ImageMagick. [1][2]
  2. Apply the fixed Rails versions and check upload directories for unexpected files. [1][2]

Sources

  1. [1]The Hacker News · Nov 4, 12:07 UTC
    Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploadscontext
  2. [2]Dark Reading · Nov 4, 21:48 UTC
    Critical Rails Bug Threatens to Derail Vulnerable Serverscontext
  3. [3]Socket Blog · Nov 6, 20:40 UTC
    Free Certified Patch for Critical Rails Active Storage Vulnerabilitycontext