Critical Rails Bug Threatens to Derail Vulnerable Servers

A critical vulnerability in Rails could send impacted Web servers off the tracks. Rails, or Ruby on Rails, is a Web application framework built on Ruby. The framework's Active Storage component handles file uploads and can use the ImageMagick image processing suite to analyze uploaded images. Unfortunately, a flaw enables attackers to write arbitrary files to a Web server via ImageMagick. The vulnerability (which is tracked as GHSA-f3w6-w445-fwh9) is critical, with a CVSS score of 9.8, and is considered so severe because an attacker could upload a crafted image file to write arbitrary files, read sensitive files, and access secrets such as secret_key_base files, external system credentials, database passwords, and third-party tokens. These secrets could then be used for lateral movement or remote code execution into external systems. As a GitHub advisory published by the Rails maintainers explains, "A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process." The vulnerability exists because ImageMagick doesn't necessarily decide how to process a file (i.e., which coder it uses) based on the filename or extension, but rather on its contents. This means an attacker can upload an image file named "maliciousfile.jpeg" that contains content that causes ImageMagick to invoke a different...