Active Storage's default vips variant processor exposes an arbitrary file read that chains to RCE on stock Rails 7.x and 8.x, where the app serves back processed variants of user-supplied images. No authentication required in certain setups. Only vips is affected, Magick is not.

Patched in 7.2.3.2, 8.0.5.1, and 8.1.3.1, and the fix requires libvips 8.13+. Chain and PoC withheld while patches roll out.

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact ------ This vulnerability impacts applications that use Active Storage with the imageprocessing processing gem in addition to minimagick as the image processor.

Vulnerable code will look something similar to this: <%= imagetag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits -------

Thank you lio346 for reporting this!

End of life: 10/10/2027, End of support: 10/10/2026, Latest version: 8.1.3.1

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact ------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue.

Credits -------

Thanks to scyoon for the report and patches!

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements.Code is only impacted if allowed tags are being overridden.

Reference:

https://hackerone.com/reports/1530898

The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

There is a possible file content disclosure vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2019-5418.

Versions Affected: All. Not affected: None. Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end

In summary, impacted calls to render look like this:

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this:

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formatsfilter.rb frozenstringliteral: true

ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "/" end end end)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

6-0-action-view-file-disclosure.patch - Patch for 6.0 series 5-2-action-view-file-disclosure.patch - Patch for 5.2 series 5-1-action-view-file-disclosure.patch - Patch for 5.1 series 5-0-action-view-file-disclosure.patch - Patch for 5.0 series 4-2-action-view-file-disclosure.patch - Patch for 4.2 series

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Also note that the patches for this vulnerability are the same as CVE-2019-5419.

Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

-- Aaron Patterson http://tenderlovemaking.com/

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 8/25/2019, End of support: 4/9/2018, Latest version: 5.1.7

End of life: 8/25/2019, End of support: 4/9/2018, Latest version: 5.1.7

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.