EN PT-BR
← Voltar ao feed
critical

Rails Active Storage flaw (CVSS 9.8) enables unauthenticated file write via ImageMagick uploads; fixed in 8.0.5.2 and 8.1.4.1

3 fonte(s) · 3 atualização(ões) · publicado 04/11/2026 06:30 · coletado há 5 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 05/11/2026 00:05; os links antigos trazem para cá.

Fontes: darkreading.com ↗ thehackernews.com ↗ securityonline.info ↗

The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues. The most severe is a critical Active Storage flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8) that lets an unauthenticated attacker write arbitrary files on the server through a crafted upload processed by ImageMagick (securityonline.info, thehackernews.com, darkreading.com). Apps using the Disk storage service can also have arbitrary files read, exposing secrets such as secret_key_base and credentials, which can lead to remote code execution or lateral movement. The bug was reported via HackerOne by RyotaK of GMO Flatt Security (thehackernews.com; securityonline.info gives the handle as ryotak). Rails says one exploitation chain was reported but has not confirmed in-the-wild exploitation (thehackernews.com), and no public PoC has been reported (securityonline.info). A second high-severity flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8), was fixed in the same release.

Entenda a falha

A vulnerabilidade

GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE yet) is in the Active Storage ImageMagick analyzer in Ruby on Rails. An unauthenticated attacker who can upload a crafted file can write arbitrary files on the server. With the Disk service they can also read any file the app can read, such as secret_key_base and credentials, which can lead to RCE or lateral movement. The app must use variant_processor = :mini_magick (the default on load_defaults 6.1 or earlier), have an ImageMagick policy that does not block the coders (Debian and Ubuntu defaults do not), and accept untrusted uploads. All versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. A second flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8), let attackers choose the FFmpeg/ImageMagick decoder through the file extension. CVE-2020-8164 appears only as the flaw that GHSA-wm3x-v3qw-4jh3 (CVSS 7.5, Strong Parameters bypass via Parameters#each_key) incompletely fixed.

Como funciona

A user uploads a file to a Rails app and attaches it through Active Storage. The ImageMagick analyzer runs automatically on attach, so no variant, preview or analyze call is needed. ImageMagick chooses a format handler, called a coder, from the file's content. Some coders act on other files named inside the file instead of the image itself. Active Storage placed no limit on which coders could be used, so a crafted upload, an SVG according to the fixing commit, reached the MSL scripting coder, which reads and writes files named by its script. This is where file write, and file read with the Disk service, happens.

Por que é vulnerável

Active Storage trusted ImageMagick to pick a coder from file content and imposed no restriction of its own, so the server's ImageMagick policy was the only barrier, and common distro policies do not block the dangerous coders. The fix ships an ImageMagick policy that MiniMagick applies to its commands. It blocks the MSL coder, coders that read or delete other files, coders that fetch remote or local references, all Ghostscript coders, the gs delegate and @filename indirection. For the second flaw, the cause was keeping the upload's extension in temporary file names, letting the attacker pick the decoder.

Onde está

The ImageMagick analyzer in Active Storage; the fix ships the policy file activestorage/lib/active_storage/image_magick/policy.xml, and Rails also published patches for 8.1 and 8.0.

Como foi descoberta

The flaw was reported through HackerOne by RyotaK, a researcher at GMO Flatt Security. The Rails team disclosed it in an advisory with the 8.0.5.2 and 8.1.4.1 releases on November 4, 2026, which fixed 21 issues. Rails says one attack chain was reported but it does not assume it is the only one. The advisory does not say whether the flaw has been exploited, and no in-the-wild exploitation is confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:21.

Detalhes técnicos

  • GHSA-f3w6-w445-fwh9 (CVSS 9.8): the Active Storage ImageMagick analyzer invokes ImageMagick's MSL coder without restricting which coders can be used. ImageMagick picks a coder from file content, so a crafted upload triggers arbitrary file writes, and file reads with the Disk service. The analyzer runs automatically when a file is attached, so no variant, preview or analyze call is needed (thehackernews.com, securityonline.info).
  • Affected: apps with config.active_storage.variant_processor = :mini_magick (the default before Rails 7.0 load_defaults), whose ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and which accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected (thehackernews.com).
  • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder. A .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE (securityonline.info).
  • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, allowing a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164). Only custom code calling this method is affected (securityonline.info).
  • Other fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress (securityonline.info).
  • This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick (thehackernews.com). securityonline.info notes that flaw saw an early PoC release.
  • Rails 8.0 security support ends November 7, 2026 (securityonline.info).

Remediação

  • Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. The app will fail to boot after upgrading with an older mini_magick (securityonline.info).
  • Verify the new ImageMagick policy loads via MiniMagick.identify. It does not apply if the app overrides MiniMagick's CLI environment or uses GraphicsMagick (thehackernews.com).
  • If you cannot upgrade, block the MSL coder, Ghostscript coders and the gs delegate in the system policy.xml (thehackernews.com), or copy the shipped ImageMagick policy into it (securityonline.info).
  • If using the Disk service, rotate secret_key_base, master keys, credentials.yml.enc contents, and all database, storage and third-party credentials the app process can read.
  • Strip client-supplied Forwarded headers at the reverse proxy (securityonline.info).
  • Plan migration to Rails 8.1 before Rails 8.0 support ends.

Relatos divergentes

  • Exploitation status: securityonline.info reports no in-the-wild exploitation or public PoC. thehackernews.com says Rails received one reported exploitation chain but has not confirmed in-the-wild exploitation. darkreading.com does not say. Treat exploitation as unconfirmed.
  • Detail level: darkreading.com gives no CVE, version ranges or fixed versions, and its generic advice to consult advisories and restrict uploads is superseded by the specific versions and mitigations from thehackernews.com and securityonline.info.

Linha do tempo

  1. darkreading.com ↗ · pub. 04/11/2026 18:48 · coletado 04/11 20:00 só resumo do feed

    Critical Rails Active Storage Flaw Allows Arbitrary File Read/Write via Malicious Image Uploads

    ler a análise desta fonte

    A critical vulnerability has been disclosed in Ruby on Rails' Active Storage framework, specifically in its integration with ImageMagick for image processing. The flaw allows an attacker to craft malicious image uploads that trigger arbitrary file writes and reads on vulnerable servers. Successful exploitation could let an attacker plant files on the server or exfiltrate sensitive data, potentially serving as a foothold for lateral movement within a compromised environment. The article does not specify a CVE identifier, affected version ranges, or whether the flaw is being actively exploited in the wild.

    Technical Details

    The vulnerability resides in how Active Storage processes uploaded images through its ImageMagick integration, enabling attackers to manipulate file handling logic to write or read files outside intended boundaries. This class of bug (arbitrary file read/write via image processing) can be leveraged to deploy webshells or extract configuration and credential files, increasing the risk of further compromise.

    Remediation

    Organizations running Rails applications that rely on Active Storage with ImageMagick should consult official Rails security advisories for patched versions and apply updates promptly. Until patched, administrators should review and restrict file upload handling and consider disabling or sandboxing ImageMagick-based image processing where feasible.

  2. thehackernews.com ↗ · pub. 04/11/2026 09:07 · coletado 04/11 10:00

    Critical Ruby on Rails Active Storage Flaw Enables Unauthenticated Arbitrary File Write via ImageMagick Uploads

    ler a análise desta fonte

    Ruby on Rails disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage that lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file when the app processes uploads with ImageMagick. Apps that store uploads using Active Storage's Disk service can also have arbitrary files read, exposing secrets such as secret_key_base and credentials, which can enable remote code execution or lateral movement. The flaw stems from Active Storage's ImageMagick analyzer invoking ImageMagick's MSL coder without restricting which coders can be used, reachable simply by attaching an uploaded file (no variant or preview generation required). Rails fixed the issue, along with a second high-severity flaw (GHSA-v924-7rp8-4mxh, CVSS 8.8) affecting ImageMagick/FFmpeg decoder selection via filename extensions, in versions 8.1.4.1 and 8.0.5.2, which together patch 21 security issues. The researcher RyotaK of GMO Flatt Security reported the issue via HackerOne; Rails says one exploitation chain was reported but has not confirmed whether the flaw has been exploited in the wild.

    Technical Details

    Apps are affected only if they use config.active_storage.variant_processor = :mini_magick (the default before Rails 7.0 load_defaults), their ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and they accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick.

    Remediation

    Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. Verify the new ImageMagick policy loads correctly via MiniMagick.identify, and note it does not apply if the app overrides MiniMagick's CLI environment, or if it uses GraphicsMagick. Apps that cannot upgrade should manually block the MSL coder, Ghostscript coders, and the gs delegate in ImageMagick's system policy.xml. Apps using the Disk service should rotate secret_key_base, master keys, credentials.yml.enc contents, and all database/storage/third-party credentials the app process can read.

  3. securityonline.info ↗ · pub. 04/11/2026 06:30 · coletado 04/11 08:52 primeiro registro

    Critical Rails Active Storage Flaw (CVSS 9.8) Allows Unauthenticated File Write via Crafted Uploads

    ler a análise desta fonte

    The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues, the most severe being a critical (CVSS 9.8) Active Storage bug allowing an unauthenticated attacker to write arbitrary files via a crafted image upload. Because the ImageMagick analyzer runs automatically upon file attachment, no variant, preview, or analyze call is required, making exploitation trivial for apps using the default mini_magick processor. Exposed secrets like secret_key_base and external credentials could enable escalation to remote code execution or lateral movement. No in-the-wild exploitation or public PoC has been reported yet, though this follows a similar July Active Storage flaw (CVE-2026-66066) that saw early PoC release.

    Technical Details

    • GHSA-f3w6-w445-fwh9 (CVSS 9.8): ImageMagick selects a "coder" based on file content; unrestricted coders let crafted uploads trigger arbitrary file writes, and file reads when using the Disk storage service. Reported by HackerOne researcher ryotak.
    • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder; a .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE.
    • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, enabling a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164); only custom code calling this method is affected.
    • Additional fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress.
    • Rails 8.0 security support ends November 7, 2026, just three days after this release.

    Remediation

    • Upgrade to Rails 8.0.5.2 or 8.1.4.1 immediately.
    • Use mini_magick 5.1 or later, or the app will fail to boot after upgrading.
    • If using the Disk storage service, rotate secret_key_base, the master key, and all accessible credentials.
    • If unable to upgrade, copy the shipped ImageMagick policy into the system policy.xml.
    • Strip client-supplied Forwarded headers at the reverse proxy.
    • Plan migration to Rails 8.1 before Rails 8.0 support ends.