Active Storage's default vips variant processor exposes an arbitrary file read that chains to RCE on stock Rails 7.x and 8.x, where the app serves back processed variants of user-supplied images. No authentication required in certain setups. Only vips is affected, Magick is not.

Patched in 7.2.3.2, 8.0.5.1, and 8.1.3.1, and the fix requires libvips 8.13+. Chain and PoC withheld while patches roll out.

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements.Code is only impacted if allowed tags are being overridden.

Reference:

https://hackerone.com/reports/1530898

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact ------ This vulnerability impacts applications that use Active Storage with the imageprocessing processing gem in addition to minimagick as the image processor.

Vulnerable code will look something similar to this: <%= imagetag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits -------

Thank you lio346 for reporting this!

End of life: 10/10/2027, End of support: 10/10/2026, Latest version: 8.1.3.1

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact ------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue.

Credits -------

Thanks to scyoon for the report and patches!

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

XSS vulnerability in sanitizecss in Action Pack

There is an XSS vulnerability in the sanitizecss method in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2013-1855.

Versions Affected: All. Not affected: None. Fixed Versions: 3.2.13, 3.1.12

Impact ------ Carefully crafted text can bypass the sanitization provided in the sanitizecss method in Action Pack. Impacted code will look like this:

sanitizecss(someuserinput)

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this issue, you can apply the following monkey patch:

module HTML class WhiteListSanitizer # Sanitizes a block of css code. Used by #sanitize when it comes across a style attribute def sanitizecss(style) # disallow urls style = style.tos.gsub(/url\s\(\s[^\s)]+?\s\)\s/, ' ')

# gauntlet if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))\z/ || style !~ /\A(\s[-\w]+\s:\s[^:;](;|$)\s)\z/ return '' end

clean = [] style.scan(/([-\w]+)\s:\s([^:;])/) do |prop,val| if allowedcssproperties.include?(prop.downcase) clean << prop + ': ' + val + ';' elsif shorthandcssproperties.include?(prop.split('-')[0].downcase) unless val.split().any? do |keyword| !allowedcsskeywords.include?(keyword) && keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d%?,?\d%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/ end clean << prop + ': ' + val + ';' end end end clean.join(' ') end end end

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-csssanitize.patch - Patch for 3.2 series 3-1-csssanitize.patch - Patch for 3.1 series 3-0-csssanitize.patch - Patch for 3.0 series 2-3-csssanitize.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Charlie Somerville for reporting this!

Symbol DoS vulnerability in Active Record

There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier CVE-2013-1854.

Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12

Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example,

User.where(:name => { 'foo' => 'bar' })

the string 'foo' will be converted to a symbol. Impacted code will look something like this:

User.where(:name => params[:name])

Carefully crafted requests can coerce params[:name] to return a hash, and the keys to that hash may be converted to symbols.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this problem, change code that looks like this:

User.where(:name => params[:name])

to code like this:

User.where(:name => params[:name].tos)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-attributesymbols.patch - Patch for 3.2 series 3-1-attributesymbols.patch - Patch for 3.1 series 2-3-attributesymbols.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Ben Murphy for reporting this!

The Ruby on Rails project reports:

Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0333.

Versions Affected: 2.3.x, 3.0.x Not Affected: 3.1.x, 3.2.x Fixed Versions: 3.0.20, 2.3.16

Impact ------ The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing backends. One of the backends involves transforming the JSON into YAML, and passing that through the YAML parser. Using a specially crafted payload attackers can trick the backend into decoding a subset of YAML.

Note: This is a seperate vulnerability to CVE-2013-0156, if you are running a 2.3 or 3.0 application you must still take action to protect your application.

Releases -------- The 3.0.20 and 2.3.16 releases are available at the normal locations.

Workarounds ----------- To work around this vulnerability you need to switch backends to the JsonGem backend. Place this code in an application initializer:

ActiveSupport::JSON.backend = "JSONGem"

If you are running Ruby 1.8 you will need to ensure that the json or jsonpure gems are installed and in your application's Gemfile. Ruby 1.9 includes this code already.

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

2-3-json-parser.patch - Patch for 2.3 series 3-0-json-parser.patch - Patch for 3.0 series

Please note that only the 2.3.x, 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Lawrence Pit of Mirror42 for discovering the vulnerability and working responsibly with us to ensure we shipped a fix.

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.

The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

The Ruby on Rails project reports:

Multiple vulnerabilities in parameter parsing in ActionPack

There are multiple weaknesses in the parameter parsing code for Ruby on Rails which could allow attackers to bypass authentication systems, inject arbitrary SQL, inject an execute arbitrary code, or perform a DoS attack on a rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.

Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15

Impact ------ The XML parameter parsing code of Ruby on Rails allows applications to automatically to cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including. This unsuitable conversion can be used by an attacker to compromise a rails application.

Due to the serious nature of this vulnerability, and the fact it has been disclosed publicly, all users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The FIXED releases are available at the normal locations.

Workarounds ----------- The work arounds differ depending on the rails version you are using. It involves disabling the YAML and Symbol type conversion from the Rails XML parser. You should place one of the following code snippets in an application initializer to ensure your application isn't vulnerable.

Rails 3.2, 3.1, 3.0 ---------

ActiveSupport::XmlMini::PARSING.delete("symbol") ActiveSupport::XmlMini::PARSING.delete("yaml")

Rails 2.3 ---------

ActiveSupport::CoreExtensions::Hash::Conversions::XMLPARSING.delete('symbol') ActiveSupport::CoreExtensions::Hash::Conversions::XMLPARSING.delete('yaml')

A possibility to circumvent protection against cross-site request forgery (CSRF) attacks was found in Ruby on Rails. Quoting upstream security advisory for exact details:

There is a bug in all 2.1.x versions of Ruby on Rails which affects the effectiveness of the CSRF protection given by protectfromforgery.

By design rails does not perform token verification on requests with certain content types not typically generated by browsers. Unfortunately this list also included ‘text/plain’ which can be generated by browsers.

Requests can be crafted which will circumvent the CSRF protection entirely. Rails does not parse the parameters provided with these requests, but that may not be enough to protect your application.

References: ----------- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1

Upstream patch: --------------- http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/11/28/1

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

There is a possible file content disclosure vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2019-5418.

Versions Affected: All. Not affected: None. Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end

In summary, impacted calls to render look like this:

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this:

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formatsfilter.rb frozenstringliteral: true

ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "/" end end end)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

6-0-action-view-file-disclosure.patch - Patch for 6.0 series 5-2-action-view-file-disclosure.patch - Patch for 5.2 series 5-1-action-view-file-disclosure.patch - Patch for 5.1 series 5-0-action-view-file-disclosure.patch - Patch for 5.0 series 4-2-action-view-file-disclosure.patch - Patch for 4.2 series

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Also note that the patches for this vulnerability are the same as CVE-2019-5419.

Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

-- Aaron Patterson http://tenderlovemaking.com/

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1