Rails flaw lets attackers read and write server files

A critical flaw in Rails could allow an attacker to write arbitrary files to a vulnerable Web server and read sensitive files via the Active Storage ImageMagick integration. The vulnerability, tracked as GHSA-f3w6-w445-fwh9, carries a CVSS score of 9.8.

The weakness arises when ImageMagick processes uploaded images used by Active Storage; an attacker can craft an image that triggers the wrong coder, enabling writes or reads of arbitrary files, including secrets such as secret_key_base, credentials, and third‑party tokens. The Rails advisory notes that an unauthenticated attacker could exploit this when attachments are stored with the Disk service.

Affected versions include Rails Active Storage in 8.0 prior to 8.0.5.2 and 8.1 prior to 8.1.4.1. Mitigations are available via Active Storage patches, and the GitHub advisory provides additional steps for applications using MiniMagick and ImageMagick. For deployments storing attachments on Disk, the advisory urges changing all secrets readable by the application process—secret_key_base, master keys, config/credentials.yml[.]enc contents, storage and database credentials, and any third‑party tokens.

The guidance also offers system policy rules for ImageMagick as a workaround, and emphasises that organisations should not keep exposed secrets as a fallback.

Jake Knott, head of threat intelligence at watchTowr, told Dark Reading that the firm has reproduced the vulnerability in a lab and that exploitation would not be difficult against a suitable target. He cautioned that while reproducing the vulnerability is straightforward, finding widely deployed, vulnerable configurations at scale will be the harder part.