ThreatRoundup
CriticalDark Reading

A Poisoned Profile Picture Can Spill a Rails App’s Secrets

Rails patched a critical Active Storage flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8) where a crafted image upload makes ImageMagick write files and, with Disk storage, read secrets like secret_key_base. Fixed in 8.0.5.2 and 8.1.4.1.

ThreatRoundup · · 2 min read

A Rails app that lets strangers upload pictures may be letting them read its secrets too. Rails maintainers have patched a critical Active Storage flaw where a crafted upload makes ImageMagick write files to the server and, in common setups, read files such as secret_key_base, Dark Reading reports. watchTowr told the outlet it has already reproduced it in a lab.

For defenders

The bug: GHSA-f3w6-w445-fwh9, published Nov. 4, CVSS 9.8, no CVE assigned yet. ImageMagick picks a coder from a file’s contents, not its name, and some coders act on files named inside the image. Active Storage didn’t restrict any coders, and its ImageMagick analyzer runs as soon as a file is attached, so a crafted “image” from an unauthenticated user can write arbitrary files, and with the Disk storage service read anything the app process can read: secret_key_base, the master key, database and cloud credentials, third-party tokens. Those can lead to remote code execution or lateral movement. Reported by ryotak via HackerOne.

Affected: activestorage before 8.0.5.2, and 8.1 before 8.1.4.1, when the app uses ImageMagick for Active Storage (variant_processor = :mini_magick, the default for apps on load_defaults 6.1 or earlier), runs ImageMagick under a policy that doesn’t deny the coders involved (Debian’s and Ubuntu’s packaged policies don’t), and accepts uploads from untrusted users.

Fix: upgrade to 8.0.5.2 or 8.1.4.1, which ship an ImageMagick policy denying the MSL coder, Ghostscript coders and delegate, and @filename indirection. It requires mini_magick 5.1 or later, or the app won’t boot. Apps that render PDF or PostScript through ImageMagick must re-allow those coders. If attachments use the Disk service, rotate secret_key_base and every secret the app can read, with no fallback to old values. The advisory gives policy rules for a workaround.

Exploitation: none reported. watchTowr’s Jake Knott expects public exploit code within days, and says finding vulnerable deployments, not building the exploit, is the hard part.

What it means for you

This is for people who build or run websites on Ruby on Rails. If your site lets visitors upload profile photos or other images, it may be exposed until it’s updated. If you don’t run a Rails app, there’s nothing to do; if you pay someone to run one, send them this.

Do this now

  1. Upgrade activestorage to 8.0.5.2 or 8.1.4.1 (and mini_magick to 5.1 or later).
  2. If you can’t upgrade today, add the advisory’s deny rules to ImageMagick’s system policy.xml.
  3. If you store uploads on local disk, rotate secret_key_base, the master key and all credentials the app can read.

More from the Roundup