Critical Ruby on Rails Flaw Allows Arbitrary File Write via Crafted ImageMagick Uploads

Critical Vulnerability in Active Storage

Ruby on Rails has disclosed a critical flaw in its Active Storage component, which handles file uploads. This vulnerability, tracked as GHSA-f3w6-w445-fwh9, allows an unauthenticated attacker to write arbitrary files to an application's server. The flaw is present if the application processes uploads using ImageMagick and stores files via Active Storage's Disk service.

Potential for Data Exposure and RCE

In affected applications, an attacker could also read any file the application has access to. This typically includes sensitive data such as the app's secret_key_base and credentials for other systems. Accessing these files could enable remote code execution (RCE) or lateral movement into other connected systems. The Rails project rates this flaw with a CVSS score of 9.8 out of 10.

Technical Details of the Flaw

The vulnerability stems from ImageMagick's ability to select format handlers (coders) based on file content. Some coders can act on other files referenced within the image, not just the image itself. Active Storage previously imposed no restrictions on which coders an upload could use. The ImageMagick analyzer in Active Storage runs when a file is attached, making attachment alone sufficient to trigger the flaw. An uploaded SVG file could reach ImageMagick's MSL coder, a scripting coder capable of reading and writing files specified in its script.

Affected Applications and Remediation

An application is vulnerable if it uses ImageMagick for Active Storage image processing (config.active_storage.variant_processor = :mini_magick), its ImageMagick security policy does not block the involved coders (default policies in Debian and Ubuntu do not), and it accepts file uploads from untrusted users. The flaw has been fixed in Rails versions 8.1.4.1 and 8.0.5.2. Users are advised to update their Rails installations to these patched versions.