Rails fixes 9.8 Active Storage flaw that lets one crafted upload write server files
Rails fixed the flaw in 8.0.5.2 and 8.1.4.1 on November 4th and told Disk service users to rotate secret_key_base and every other readable secret.
By Ryan Merket · Published
Primary source: github.com
Why it matters
A crafted upload can reach file-writing ImageMagick coders as soon as it is attached, before a preview or variant is requested. For Disk service applications, Rails also describes a file-read path to secret_key_base and other credentials, so the response combines a framework upgrade with secret rotation.
Rails disclosed a critical flaw in Active Storage on November 4th that can let an unauthenticated attacker write arbitrary files on a server by uploading a crafted file to an application that processes attachments with ImageMagick. The Rails advisory says that when attachments use the Disk service, the same attack path can also read arbitrary files readable by the application process.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.