EN PT-BR
← Voltar ao feed
high

Critical Rails Active Storage Flaw (CVSS 9.8) Allows Unauthenticated File Write via Crafted Uploads

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 06:30 · coletado há 1 hora

The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues, the most severe being a critical (CVSS 9.8) Active Storage bug allowing an unauthenticated attacker to write arbitrary files via a crafted image upload. Because the ImageMagick analyzer runs automatically upon file attachment, no variant, preview, or analyze call is required, making exploitation trivial for apps using the default mini_magick processor. Exposed secrets like secret_key_base and external credentials could enable escalation to remote code execution or lateral movement. No in-the-wild exploitation or public PoC has been reported yet, though this follows a similar July Active Storage flaw (CVE-2026-66066) that saw early PoC release.

Entenda a falha

A vulnerabilidade

Rails Active Storage's image analysis (GHSA-f3w6-w445-fwh9, CVSS 9.8) lets an unauthenticated attacker write arbitrary files on the server through a crafted image upload; with the Disk storage service, arbitrary files the app can read are also exposed. It requires the mini_magick variant processor (default for load_defaults 6.1 or earlier) and an app accepting untrusted uploads. Also fixed: GHSA-v924-7rp8-4mxh (CVSS 8.8), where preserved upload extensions let attackers pick the FFmpeg/ImageMagick decoder, possibly leading to RCE; and GHSA-wm3x-v3qw-4jh3 (CVSS 7.5), a Strong Parameters bypass via Parameters#each_key, an incomplete fix of CVE-2020-8164. Fixed in 8.0.5.2 and 8.1.4.1.

Como funciona

A user uploads an image to a Rails app and Active Storage attaches it. The ImageMagick analyzer runs immediately on attachment, so no variant, preview or analyze call is needed. ImageMagick chooses a coder based on the file's content, and some coders act on files named inside the image rather than on the image itself. Because Active Storage restricted no coders, a crafted upload triggers one of them, and ImageMagick writes (or reads) files outside the intended handling.

Por que é vulnerável

Active Storage did not restrict which ImageMagick coders could be used, trusting content-based coder selection on untrusted uploads. The Debian and Ubuntu ImageMagick policies do not block the coders involved, according to Rails. For the related bug, Active Storage kept the uploaded extension when invoking FFmpeg/ImageMagick, which pick decoders by extension. The fix ships an ImageMagick policy restricting coders (the workaround is copying it into the system policy.xml) and requires mini_magick 5.1 or later.

Onde está

The articles name Active Storage image analysis (ImageMagick analyzer, mini_magick processor), advisory GHSA-f3w6-w445-fwh9, and Parameters#each_key for the Strong Parameters bug; no files or commits are given.

Como foi descoberta

The critical flaw was reported by HackerOne researcher ryotak. The Rails team disclosed it through security advisories alongside the 8.0.5.2 and 8.1.4.1 releases on November 4, 2026, which fixed 21 issues. No exploitation in the wild has been reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:08.

Detalhes técnicos

  • GHSA-f3w6-w445-fwh9 (CVSS 9.8): ImageMagick selects a "coder" based on file content; unrestricted coders let crafted uploads trigger arbitrary file writes, and file reads when using the Disk storage service. Reported by HackerOne researcher ryotak.
  • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder; a .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE.
  • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, enabling a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164); only custom code calling this method is affected.
  • Additional fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress.
  • Rails 8.0 security support ends November 7, 2026, just three days after this release.

Remediação

  • Upgrade to Rails 8.0.5.2 or 8.1.4.1 immediately.
  • Use mini_magick 5.1 or later, or the app will fail to boot after upgrading.
  • If using the Disk storage service, rotate secret_key_base, the master key, and all accessible credentials.
  • If unable to upgrade, copy the shipped ImageMagick policy into the system policy.xml.
  • Strip client-supplied Forwarded headers at the reverse proxy.
  • Plan migration to Rails 8.1 before Rails 8.0 support ends.

Linha do tempo

  1. securityonline.info ↗ · pub. 04/11/2026 06:30 · coletado 04/11 08:52 primeiro registro

    Critical Rails Active Storage Flaw (CVSS 9.8) Allows Unauthenticated File Write via Crafted Uploads

    ler a análise desta fonte

    The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues, the most severe being a critical (CVSS 9.8) Active Storage bug allowing an unauthenticated attacker to write arbitrary files via a crafted image upload. Because the ImageMagick analyzer runs automatically upon file attachment, no variant, preview, or analyze call is required, making exploitation trivial for apps using the default mini_magick processor. Exposed secrets like secret_key_base and external credentials could enable escalation to remote code execution or lateral movement. No in-the-wild exploitation or public PoC has been reported yet, though this follows a similar July Active Storage flaw (CVE-2026-66066) that saw early PoC release.

    Technical Details

    • GHSA-f3w6-w445-fwh9 (CVSS 9.8): ImageMagick selects a "coder" based on file content; unrestricted coders let crafted uploads trigger arbitrary file writes, and file reads when using the Disk storage service. Reported by HackerOne researcher ryotak.
    • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder; a .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE.
    • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, enabling a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164); only custom code calling this method is affected.
    • Additional fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress.
    • Rails 8.0 security support ends November 7, 2026, just three days after this release.

    Remediation

    • Upgrade to Rails 8.0.5.2 or 8.1.4.1 immediately.
    • Use mini_magick 5.1 or later, or the app will fail to boot after upgrading.
    • If using the Disk storage service, rotate secret_key_base, the master key, and all accessible credentials.
    • If unable to upgrade, copy the shipped ImageMagick policy into the system policy.xml.
    • Strip client-supplied Forwarded headers at the reverse proxy.
    • Plan migration to Rails 8.1 before Rails 8.0 support ends.