Rails Active Storage ImageMagick Flaw Allows File Writes

Critical Rails flaw. Patched in 8.1.4.1 and 8.0.5.2. No CVE identifier yet. Exploitation: unconfirmed, the advisory does not say.

The Hacker News reports that the Rails project disclosed GHSA-f3w6-w445-fwh9 in Active Storage. Rails rates it 9.8 on the CVSS scale. An unauthenticated attacker uploading a crafted file can write arbitrary files on the server, if the app processes uploads with ImageMagick.

Confirmed:

• The ImageMagick analyzer runs when a file is attached. No variant or preview is needed.
• Apps using the Disk service face a second exposure: arbitrary file reads. Rails says those files typically include secret_key_base and credentials for other systems.
• One attack chain was reported. Rails says it does “not assume it is the only one that exists.”
• Reporter: RyotaK of GMO Flatt Security, via HackerOne.

Analysis: stolen secrets could extend the damage beyond the app. How far depends on the deployment. The source does not say.

Affected only if all three hold:

1. ImageMagick handles Active Storage images (variant_processor = :mini_magick). That is the default on load_defaults 6.1 or earlier. From 7.0 the default is :vips.
2. The server’s ImageMagick policy does not block the coders involved. Rails says the policies Debian and Ubuntu ship do not.
3. The app accepts uploads from untrusted users.

Every version before 8.0.5.2 is affected, as is 8.1 before 8.1.4.1. Series older than 8.0 are unsupported and will get no fixed releases.

Same releases fix a second flaw, GHSA-v924-7rp8-4mxh, which Rails rates high at 8.8. Temporary upload names kept the uploaded file’s extension, so an attacker-chosen filename and content type could steer which decoder ran. The two releases fix 21 security issues in total.

Patch status: fixed versions ship an ImageMagick security policy. The cited report gives no workaround for apps that cannot upgrade.