EN PT-BR
← Voltar ao feed
critical

Rails Active Storage flaw (CVSS 9.8) enables unauthenticated file write via ImageMagick uploads; fixed in 8.0.5.2 and 8.1.4.1

4 fonte(s) · 4 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 14 horas

Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 07/11/2026 00:03; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ darkreading.com ↗ thehackernews.com ↗ securityonline.info ↗

The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues. The vendor announcement breaks them down as 1 critical, 4 high, 13 medium and 3 low (cert.cyber.gouv.fr). The most severe is a critical Active Storage flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8) that lets an unauthenticated attacker write arbitrary files on the server through a crafted upload processed by ImageMagick (securityonline.info, thehackernews.com, darkreading.com). Apps using the Disk storage service can also have arbitrary files read, exposing secrets such as secret_key_base and credentials, which can lead to remote code execution or lateral movement. The bug was reported via HackerOne by RyotaK of GMO Flatt Security (thehackernews.com; securityonline.info gives the handle as ryotak). Rails says one exploitation chain was reported but has not confirmed in-the-wild exploitation (thehackernews.com), and no public PoC has been reported (securityonline.info). CERT-FR relayed the release in advisory CERTFR-2026-AVI-1452, citing remote code execution, remote denial of service, confidentiality and integrity impact, security policy bypass and XSS; it does not mention exploitation (cert.cyber.gouv.fr). A second high-severity flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8), was fixed in the same release.

Entenda a falha

A vulnerabilidade

The most severe flaw is GHSA-f3w6-w445-fwh9 (CVSS 9.8) in Rails Active Storage's ImageMagick analyzer. An unauthenticated attacker who can upload a crafted file can write arbitrary files on the server, and can also read files when the Disk service is used, exposing secret_key_base and credentials that may lead to RCE. It affects apps with variant_processor set to :mini_magick (the default before load_defaults 7.0) whose ImageMagick policy does not block the coders involved (Debian and Ubuntu defaults do not) and that accept untrusted uploads. Affected: Rails before 8.0.5.2 and 8.1 before 8.1.4.1; fixed in those versions. It has no confirmed CVE ID. The second flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8), lets an attacker pick the FFmpeg/ImageMagick decoder through the file extension, with possible RCE. GHSA-wm3x-v3qw-4jh3 (7.5) is a Strong Parameters bypass, an incomplete fix of CVE-2020-8164. In all, 21 issues were fixed.

Como funciona

A user uploads a file to a Rails app that stores it with Active Storage. When the file is attached, the ImageMagick analyzer runs automatically, so no variant, preview or analyze call is needed. ImageMagick picks a format handler (a coder) from the file's content, and some coders act on other files named inside the image. Active Storage placed no limit on which coders could be used, so only the server's own ImageMagick policy stood in the way. A crafted upload therefore made ImageMagick write files, and read them with the Disk service. In the second flaw, uploads were handed to FFmpeg and ImageMagick under temporary names that kept the original extension, so the attacker could steer which decoder ran.

Por que é vulnerável

For the critical flaw, Active Storage invoked ImageMagick without restricting which coders could be used, trusting the system policy to do it, and the common distribution policies do not block the dangerous ones such as MSL. For the second flaw, it kept the uploaded file's extension, which let the attacker choose the decoder. The fixed versions ship an ImageMagick policy, applied through MiniMagick, that blocks the MSL coder, coders that read or delete other files, coders that fetch references, Ghostscript coders with the gs delegate, and @filename indirection. GHSA-wm3x-v3qw-4jh3 comes from Parameters#each_key returning the raw internal hash instead of the Parameters object.

Onde está

The Active Storage ImageMagick analyzer; the Hacker News article says an SVG upload reached ImageMagick's MSL coder through it, according to the fix commit (not linked in the articles). The shipped policy is activestorage/lib/active_storage/image_magick/policy.xml, and the Strong Parameters issue is in Parameters#each_key.

Como foi descoberta

RyotaK, a researcher at GMO Flatt Security, reported the critical flaw through HackerOne. Rails disclosed it in an advisory and a security release on November 4, 2026, which CERT-FR relayed as CERTFR-2026-AVI-1452. Rails says one attack chain was reported but it does not assume that is the only one. The advisory does not say whether the flaw has been exploited, and securityonline.info reports no in-the-wild exploitation. The articles do not say who found the other flaws.

Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:18.

Detalhes técnicos

  • GHSA-f3w6-w445-fwh9 (CVSS 9.8): the Active Storage ImageMagick analyzer invokes ImageMagick's MSL coder without restricting which coders can be used. ImageMagick picks a coder from file content, so a crafted upload triggers arbitrary file writes, and file reads with the Disk service. The analyzer runs automatically when a file is attached, so no variant, preview or analyze call is needed (thehackernews.com, securityonline.info). CERT-FR describes it as an arbitrary file write and read in Active Storage image analysis (cert.cyber.gouv.fr).
  • Affected: apps with config.active_storage.variant_processor = :mini_magick (the default before Rails 7.0 load_defaults), whose ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and which accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected (thehackernews.com). CERT-FR lists affected versions as Rails 8.x before 8.1.4.1 and versions before 8.0.5.2 (cert.cyber.gouv.fr).
  • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder. A .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE (securityonline.info). CERT-FR describes it as arbitrary file read and RCE in Active Storage video previews, analysis and image processing (cert.cyber.gouv.fr).
  • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, allowing a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164). Only custom code calling this method is affected (securityonline.info).
  • Other high-severity issues per the Rails announcement: GHSA-2gff-2mmg-m73p, RemoteIp IP spoofing through the Forwarded header, affecting Rails 8.1 only, and GHSA-8474-xrp6-wh69, a DoS in safe_constantize (cert.cyber.gouv.fr).
  • Other fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress (securityonline.info). The medium and low items also include Active Storage and Action Controller Live DoS, session restoration in CacheStore, GCS direct-upload issues and a missing SameSite attribute on session cookies (cert.cyber.gouv.fr).
  • This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick (thehackernews.com). securityonline.info notes that flaw saw an early PoC release.
  • Rails will not release fixes for series older than 8.0. Rails 8.0 security support ends November 7, 2026 (securityonline.info, cert.cyber.gouv.fr).

Remediação

  • Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. The app will fail to boot after upgrading with an older mini_magick (securityonline.info, cert.cyber.gouv.fr).
  • Verify the new ImageMagick policy loads via MiniMagick.identify. It does not apply if the app overrides MiniMagick's CLI environment or uses GraphicsMagick (thehackernews.com).
  • If you cannot upgrade, block the MSL coder, Ghostscript coders and the gs delegate in the system policy.xml (thehackernews.com), or copy the shipped ImageMagick policy into it (securityonline.info).
  • If using the Disk service, rotate secret_key_base, master keys, credentials.yml.enc contents, and all database, storage and third-party credentials the app process can read.
  • Strip client-supplied Forwarded headers at the reverse proxy (securityonline.info).
  • Apps on unsupported series, such as 7.x, should move to a supported branch, since Rails will not patch series older than 8.0 (cert.cyber.gouv.fr).
  • Plan migration to Rails 8.1 before Rails 8.0 support ends.

Relatos divergentes

  • Exploitation status: securityonline.info reports no in-the-wild exploitation or public PoC. thehackernews.com says Rails received one reported exploitation chain but has not confirmed in-the-wild exploitation. darkreading.com and cert.cyber.gouv.fr do not say. Treat exploitation as unconfirmed.
  • Detail level: darkreading.com gives no CVE, version ranges or fixed versions, and its generic advice to consult advisories and restrict uploads is superseded by the specific versions and mitigations from thehackernews.com, securityonline.info and cert.cyber.gouv.fr.
  • CVE identifier: cert.cyber.gouv.fr says the Rails announcement gives no CVE IDs and the advisory names none. It notes that one secondary source lists GHSA-f3w6-w445-fwh9 as CVE-2026-122006 with CVSS 9.8, which the vendor announcement does not confirm. Treat that CVE ID as unconfirmed and use the GHSA ID.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 06/11 12:00

    CERT-FR: 21 vulnerabilities fixed in Ruby on Rails 8.0.5.2 and 8.1.4.1, including critical Active Storage file write and RCE

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1452 relays the Ruby on Rails security release of 4 November 2026. The release ships 8.0.5.2 and 8.1.4.1. CERT-FR says the flaws allow remote code execution, remote denial of service, confidentiality and integrity impact, security policy bypass and XSS. Affected versions are Rails 8.x before 8.1.4.1 and versions before 8.0.5.2. The advisory names no CVE IDs and does not mention exploitation.

    Technical Details

    The Rails announcement (discuss.rubyonrails.org) lists 21 issues by GHSA ID: 1 critical, 4 high, 13 medium and 3 low. The announcement gives no CVE IDs, credits or per-issue prerequisites.

    • Critical: GHSA-f3w6-w445-fwh9 is an arbitrary file write and read in Active Storage image analysis. One secondary source rates it CVSS 9.8 and says it is exploitable by an unauthenticated attacker through a crafted upload when the app processes images with ImageMagick. The same source lists it as CVE-2026-122006. This was not confirmed in the vendor announcement.
    • High: GHSA-v924-7rp8-4mxh covers arbitrary file read and RCE in Active Storage video previews, analysis and image processing. GHSA-wm3x-v3qw-4jh3 is a Strong Parameters bypass in Parameters#each_key. GHSA-2gff-2mmg-m73p is RemoteIp IP spoofing through the Forwarded header and affects 8.1 only. GHSA-8474-xrp6-wh69 is a DoS in safe_constantize.
    • Medium and low: These include several Action View XSS issues, Active Storage and Action Controller Live DoS, session restoration in CacheStore, cache poisoning through content negotiation, GCS direct-upload issues, a Mailgun signature replay and a missing SameSite attribute on session cookies.
    • Rails will not release fixes for series older than 8.0. Security support for 8.0 ends on 7 November 2026.

    Remediation

    Upgrade to Rails 8.0.5.2 or 8.1.4.1 as soon as possible, as the vendor recommends. Apps on :mini_magick also need mini_magick 5.1 or later, or they raise an error at boot (per a secondary source). Apps on unsupported series, such as 7.x, should move to a supported branch. Rails 8.0 reaches end of security support on 7 November 2026.

  2. darkreading.com ↗ · pub. 04/11/2026 18:48 · coletado 04/11 20:00 só resumo do feed

    Critical Rails Active Storage Flaw Allows Arbitrary File Read/Write via Malicious Image Uploads

    ler a análise desta fonte

    A critical vulnerability has been disclosed in Ruby on Rails' Active Storage framework, specifically in its integration with ImageMagick for image processing. The flaw allows an attacker to craft malicious image uploads that trigger arbitrary file writes and reads on vulnerable servers. Successful exploitation could let an attacker plant files on the server or exfiltrate sensitive data, potentially serving as a foothold for lateral movement within a compromised environment. The article does not specify a CVE identifier, affected version ranges, or whether the flaw is being actively exploited in the wild.

    Technical Details

    The vulnerability resides in how Active Storage processes uploaded images through its ImageMagick integration, enabling attackers to manipulate file handling logic to write or read files outside intended boundaries. This class of bug (arbitrary file read/write via image processing) can be leveraged to deploy webshells or extract configuration and credential files, increasing the risk of further compromise.

    Remediation

    Organizations running Rails applications that rely on Active Storage with ImageMagick should consult official Rails security advisories for patched versions and apply updates promptly. Until patched, administrators should review and restrict file upload handling and consider disabling or sandboxing ImageMagick-based image processing where feasible.

  3. thehackernews.com ↗ · pub. 04/11/2026 09:07 · coletado 04/11 10:00

    Critical Ruby on Rails Active Storage Flaw Enables Unauthenticated Arbitrary File Write via ImageMagick Uploads

    ler a análise desta fonte

    Ruby on Rails disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage that lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file when the app processes uploads with ImageMagick. Apps that store uploads using Active Storage's Disk service can also have arbitrary files read, exposing secrets such as secret_key_base and credentials, which can enable remote code execution or lateral movement. The flaw stems from Active Storage's ImageMagick analyzer invoking ImageMagick's MSL coder without restricting which coders can be used, reachable simply by attaching an uploaded file (no variant or preview generation required). Rails fixed the issue, along with a second high-severity flaw (GHSA-v924-7rp8-4mxh, CVSS 8.8) affecting ImageMagick/FFmpeg decoder selection via filename extensions, in versions 8.1.4.1 and 8.0.5.2, which together patch 21 security issues. The researcher RyotaK of GMO Flatt Security reported the issue via HackerOne; Rails says one exploitation chain was reported but has not confirmed whether the flaw has been exploited in the wild.

    Technical Details

    Apps are affected only if they use config.active_storage.variant_processor = :mini_magick (the default before Rails 7.0 load_defaults), their ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and they accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick.

    Remediation

    Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. Verify the new ImageMagick policy loads correctly via MiniMagick.identify, and note it does not apply if the app overrides MiniMagick's CLI environment, or if it uses GraphicsMagick. Apps that cannot upgrade should manually block the MSL coder, Ghostscript coders, and the gs delegate in ImageMagick's system policy.xml. Apps using the Disk service should rotate secret_key_base, master keys, credentials.yml.enc contents, and all database/storage/third-party credentials the app process can read.

  4. securityonline.info ↗ · pub. 04/11/2026 06:30 · coletado 04/11 08:52 primeiro registro

    Critical Rails Active Storage Flaw (CVSS 9.8) Allows Unauthenticated File Write via Crafted Uploads

    ler a análise desta fonte

    The Ruby on Rails team released 8.0.5.2 and 8.1.4.1 on November 4, 2026, patching 21 security issues, the most severe being a critical (CVSS 9.8) Active Storage bug allowing an unauthenticated attacker to write arbitrary files via a crafted image upload. Because the ImageMagick analyzer runs automatically upon file attachment, no variant, preview, or analyze call is required, making exploitation trivial for apps using the default mini_magick processor. Exposed secrets like secret_key_base and external credentials could enable escalation to remote code execution or lateral movement. No in-the-wild exploitation or public PoC has been reported yet, though this follows a similar July Active Storage flaw (CVE-2026-66066) that saw early PoC release.

    Technical Details

    • GHSA-f3w6-w445-fwh9 (CVSS 9.8): ImageMagick selects a "coder" based on file content; unrestricted coders let crafted uploads trigger arbitrary file writes, and file reads when using the Disk storage service. Reported by HackerOne researcher ryotak.
    • GHSA-v924-7rp8-4mxh (CVSS 8.8): Active Storage preserved uploaded file extensions when passing files to FFmpeg/ImageMagick, letting attackers choose the decoder; a .avs file on AviSynth-enabled FFmpeg can run as a script, potentially leading to RCE.
    • GHSA-wm3x-v3qw-4jh3 (CVSS 7.5): Parameters#each_key returns the raw internal hash instead of the Parameters object, enabling a Strong Parameters mass-assignment bypass (incomplete fix of CVE-2020-8164); only custom code calling this method is affected.
    • Additional fixes: IP spoofing via the standard Forwarded header under Rack 3 on Rails 8.1 (bypassing rate limits), a safe_constantize DoS in Action Cable, five XSS bugs, cache poisoning via content negotiation, and signature replay in Action Mailbox Mailgun ingress.
    • Rails 8.0 security support ends November 7, 2026, just three days after this release.

    Remediation

    • Upgrade to Rails 8.0.5.2 or 8.1.4.1 immediately.
    • Use mini_magick 5.1 or later, or the app will fail to boot after upgrading.
    • If using the Disk storage service, rotate secret_key_base, the master key, and all accessible credentials.
    • If unable to upgrade, copy the shipped ImageMagick policy into the system policy.xml.
    • Strip client-supplied Forwarded headers at the reverse proxy.
    • Plan migration to Rails 8.1 before Rails 8.0 support ends.