Rails fixes critical flaw allowing server file writes via uploads

A critical vulnerability in Ruby on Rails’ Active Storage could let an unauthenticated attacker write arbitrary files to a server by uploading a crafted file when the app uses ImageMagick for image processing. The Rails project disclosed the flaw in an advisory and fixed it in Rails versions 8.1.4.1 and 8.0.5.2.

The issue centres on how ImageMagick selects a format handler (a coder) based on file content; some coders act on files named inside the image rather than the image itself, and Active Storage does not restrict which coders may be used. Rails notes that the vulnerability can also enable reading any file the app can read—potentially exposing secrets such as secret_key_base and credentials for other systems—which could enable remote code execution or lateral movement.

The flaw has a Severity rating of 9.8 on the CVSS scale and is tracked as GHSA-f3w6-w445-fwh9, with no CVE identifier at present. Rails has confirmed one attack chain was reported but cautions it may not be the only one, and the advisory does not state whether exploitation has occurred.

Affected apps are those which use ImageMagick for Active Storage image processing, store uploads on Disk, and accept uploads from untrusted users. Rails’ guidance requires upgrading to Rails 8.1.4[.]1 or 8.0.5[.]2 (apps on :mini_magick must also update to MiniMagick 5.1 or later), and to verify that the new ImageMagick policy is loaded.

If upgrading is not yet possible, Rails provides a set of mitigations, including incorporating the shipped policy into ImageMagick’s system policy and tightening coder blocks; readers should also review their server’s own policy.xml settings and, for Disk-stored attachments, rotate secret keys and credentials. The fixed releases address a total of 21 security issues across the two rails branches. The advisory notes that there may be other, undisclosed attack paths.