GHSA-f3w6-w445-fwh9: Critical severity vulnerability
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secretkeybase) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Event History
Frequently Asked Questions
Which deployments are exposed?
Ruby on Rails deployments using the activestorage gem before 8.1.4.1 are exposed when they perform attachment processing with ImageMagick. The issue is tied to the ImageMagick analyzer running when a file is attached.
What does an attacker need to exploit this?
The severity vector indicates exploitation is network-accessible, requires low complexity, and does not require privileges or user interaction. The relevant attack point is attachment handling that causes ImageMagick analysis to run.
What is the potential impact?
An attacker may be able to cause server-side read and write operations through unintended ImageMagick functionality. The reported examples include reading sensitive application data such as secret_key_base.
What can be done if an immediate upgrade is not possible?
The described exposure exists because there is no ImageMagick security policy blocking unintended functionality. Restricting or disabling ImageMagick-based attachment analysis until an update can be applied can reduce exposure; upgrading to a version outside the affected range is the stated remediation path.