Attack Chain

1. An attacker identifies an application using Active Storage that accepts file uploads and performs automatic attachment analysis or preview generation.
2. The attacker crafts a malicious file (e.g., an AviSynth script) and assigns it an extension corresponding to a target processing delegate (e.g., .avs).
3. The attacker uploads the file to the application.
4. Active Storage writes the file to a temporary location while preserving the attacker-provided extension.
5. The application triggers background processing (FFmpeg or ImageMagick) on the file.
6. The processing tool detects the file extension and interprets the content according to the associated decoder or library (e.g., executing the AviSynth script).
7. The process either discloses local sensitive files (if the script reads them) or executes arbitrary native code if a malicious library is loaded.

Impact

Successful exploitation may result in the unauthorized disclosure of sensitive files readable by the application process (e.g., database credentials, master keys) or remote code execution within the FFmpeg or ImageMagick processing context.

Recommendation

• Upgrade activestorage to version 8.0.5.2 or 8.1.4.1 immediately.
• If an upgrade is not immediately possible, remove ActiveStorage::Previewer::VideoPreviewer and the VideoAnalyzer/AudioAnalyzer from the config.active_storage configuration to disable affected processing.
• If the application environment included FFmpeg built with --enable-avisynth, consider all application secrets (including secret_key_base, database credentials, and service tokens) as potentially compromised; rotate these secrets immediately after patching.