Skip to content
Threat Feed
Subscribe
critical advisory updated

Ruby on Rails: Arbitrary File Read and Write via Active Storage and ImageMagick (GHSA-f3w6-w445-fwh9)

A critical vulnerability in the Rails Active Storage component allows unauthenticated attackers to perform arbitrary file reads and writes by uploading crafted image files that exploit the ImageMagick processing suite.

Triage facts

Revision 3
Applicability
Ruby on Rails, Ruby on Rails (< 8.0.5.2) +4
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
6 public sources
Freshness
Revision 3Nov 4, 22:57 UTC
Source quality
B2Roughly even chance
Revision history 2 entries · Revision 3
  1. Revision 3

    new product

    Changed: action_plan, affected_products, content, lastmod, references, severity, summary, tags, title, ttps, updates

    Sources: 1

  2. Revision 2

    ruby on rails version 8.x < 8.1.4.1

    Changed: affected_products, claim_state, lastmod, references, updates

    Sources: 1

A critical vulnerability (GHSA-f3w6-w445-fwh9) exists in the Ruby on Rails Active Storage component when configured to use ImageMagick for image processing. The flaw stems from ImageMagick selecting image decoders based on file content rather than file extensions. Unauthenticated attackers can exploit this by uploading crafted image files, enabling arbitrary file writes to the server and arbitrary file reads of any files accessible to the application process. Successful exploitation may lead to the exposure of sensitive secrets, such as secret_key_base, database credentials, and third-party tokens, facilitating lateral movement or remote code execution.

Impact

Impact includes unauthorized read/write access to the server filesystem, theft of application secrets, and potential full system compromise. If attachments are stored with the Disk service, secrets such as config/credentials.yml.enc and external system credentials are at high risk of exfiltration.

Recommendation

  • Upgrade Rails Active Storage to version 8.0.5.2, 8.1.4.1, or later.
  • If using the Disk service, rotate all application secrets immediately, including the master key, storage credentials, database passwords, and third-party API tokens, as they must be assumed compromised if previously stored.
  • Apply the recommended ImageMagick system policy rules provided in the GitHub advisory to restrict dangerous coders.
  • Inventory all Rails applications using Active Storage with ImageMagick to identify exposure.

Immediate actions

Inventory all internet-facing Ruby on Rails applications.

IT Operations 24h

Patch Rails Active Storage to 8.0.5.2 or 8.1.4.1.

IT Operations 24h

Rotate all application secrets and credentials if Disk service was used.

IT Operations 48h

Threat Hunt

Monitor for suspicious web requests targeting Rails applications (e.g., unexpected characters in input parameters, large payload bursts)

high medium confidence hunt now

Data: Web server access logs, WAF request logs

Hunt for anomalous image uploads to application endpoints followed by reads of sensitive configuration files.

high medium confidence hunt now

Data: Web server access logs, Application error logs

Mitigations

Subscribe to official Ruby on Rails security announcements and prepare for emergency patching once specific versions are announced.

immediate IT Operations

Multiple undisclosed vulnerabilities

Apply ImageMagick system policy restrictions provided in GHSA-f3w6-w445-fwh9.

immediate IT Operations

ImageMagick decoder selection flaw