REDHAT-BUG-2450546: Path Traversal
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Storage (Rails) DiskService#path_forto a version that resolves this vulnerability.Fixed in 8.1.2.1 - Upgrade
Upgrade
Active Storage (Rails) DiskService#path_forto a version that resolves this vulnerability.Fixed in 8.0.4.1 - Upgrade
Upgrade
Active Storage (Rails) DiskService#path_forto a version that resolves this vulnerability.Fixed in 7.2.3.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450546?
The severity of REDHAT-BUG-2450546 is high with a rating of 7.
What is REDHAT-BUG-2450546 about?
REDHAT-BUG-2450546 pertains to a path traversal vulnerability in Active Storage that allows users to potentially access unauthorized filesystem paths.
How do I fix REDHAT-BUG-2450546?
To fix REDHAT-BUG-2450546, upgrade to Ruby on Rails Active Storage versions 8.1.2.1, 8.0.4.1, or 7.2.3.1 or later.
What is the risk level associated with REDHAT-BUG-2450546?
The risk level associated with REDHAT-BUG-2450546 is rated at 33.
Which component of Ruby on Rails is affected by REDHAT-BUG-2450546?
The affected component of Ruby on Rails is Active Storage.