The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secretkeybase) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Deployments using the ActiveStorage gem before 8.1.4.1 are exposed when they perform attachment processing with ImageMagick. The ImageMagick analyzer runs when a file is attached.
A file must be attached so that ActiveStorage invokes the ImageMagick analyzer. The provided information does not specify what level of access is required to attach a file.
Configure an ImageMagick security policy that blocks unintended functionality. The issue is attributed to the absence of such a policy during ImageMagick attachment processing.
Check whether the ActiveStorage gem version is earlier than 8.1.4.1 and whether ImageMagick is used to process attachments. Systems that meet both conditions match the affected scenario.