Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secretkeybase and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or analyze call is required. One specific attack chain has been reported, but other attack chains may exist. An application is affected when it uses ImageMagick for Active Storage image processing through config.activestorage.variantprocessor = :minimagick, runs ImageMagick under a security policy that does not already deny the involved coders, and allows uploads from untrusted users. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#eachkey delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assignattributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of eachkey to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, eachpair and eachvalue return the Parameters instance but left eachkey delegated. An application is affected if it passes the return value of ActionController::Parameters#eachkey, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact ------ This vulnerability impacts applications that use Active Storage with the imageprocessing processing gem in addition to minimagick as the image processor.

Vulnerable code will look something similar to this: <%= imagetag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits -------

Thank you lio346 for reporting this!

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements.Code is only impacted if allowed tags are being overridden.

Reference:

https://hackerone.com/reports/1530898

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.actiondispatch.cookiesrotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.sessionoptions[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users. Applications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a :hybrid serializer migration configured, and run behind a cache that stores Set-Cookie on public responses. This is a path around the fix for CVE-2024-26144. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using loaddefaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simpleformat sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simpleformat splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's htmlsafe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simpleformat with htmloptions, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with ActionController::Live, including sendstream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.

XSS vulnerability in sanitizecss in Action Pack

There is an XSS vulnerability in the sanitizecss method in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2013-1855.

Versions Affected: All. Not affected: None. Fixed Versions: 3.2.13, 3.1.12

Impact ------ Carefully crafted text can bypass the sanitization provided in the sanitizecss method in Action Pack. Impacted code will look like this:

sanitizecss(someuserinput)

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this issue, you can apply the following monkey patch:

module HTML class WhiteListSanitizer # Sanitizes a block of css code. Used by #sanitize when it comes across a style attribute def sanitizecss(style) # disallow urls style = style.tos.gsub(/url\s\(\s[^\s)]+?\s\)\s/, ' ')

# gauntlet if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))\z/ || style !~ /\A(\s[-\w]+\s:\s[^:;](;|$)\s)\z/ return '' end

clean = [] style.scan(/([-\w]+)\s:\s([^:;])/) do |prop,val| if allowedcssproperties.include?(prop.downcase) clean << prop + ': ' + val + ';' elsif shorthandcssproperties.include?(prop.split('-')[0].downcase) unless val.split().any? do |keyword| !allowedcsskeywords.include?(keyword) && keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d%?,?\d%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/ end clean << prop + ': ' + val + ';' end end end clean.join(' ') end end end

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-csssanitize.patch - Patch for 3.2 series 3-1-csssanitize.patch - Patch for 3.1 series 3-0-csssanitize.patch - Patch for 3.0 series 2-3-csssanitize.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Charlie Somerville for reporting this!

Symbol DoS vulnerability in Active Record

There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier CVE-2013-1854.

Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12

Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example,

User.where(:name => { 'foo' => 'bar' })

the string 'foo' will be converted to a symbol. Impacted code will look something like this:

User.where(:name => params[:name])

Carefully crafted requests can coerce params[:name] to return a hash, and the keys to that hash may be converted to symbols.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this problem, change code that looks like this:

User.where(:name => params[:name])

to code like this:

User.where(:name => params[:name].tos)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-attributesymbols.patch - Patch for 3.2 series 3-1-attributesymbols.patch - Patch for 3.1 series 2-3-attributesymbols.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Ben Murphy for reporting this!

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/ or audio/ content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1.

There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact ------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue.

Credits -------

Thanks to scyoon for the report and patches!

A possibility to circumvent protection against cross-site request forgery (CSRF) attacks was found in Ruby on Rails. Quoting upstream security advisory for exact details:

There is a bug in all 2.1.x versions of Ruby on Rails which affects the effectiveness of the CSRF protection given by protectfromforgery.

By design rails does not perform token verification on requests with certain content types not typically generated by browsers. Unfortunately this list also included ‘text/plain’ which can be generated by browsers.

Requests can be crafted which will circumvent the CSRF protection entirely. Rails does not parse the parameters provided with these requests, but that may not be enough to protect your application.

References: ----------- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1

Upstream patch: --------------- http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/11/28/1

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 8/25/2019, End of support: 4/9/2018, Latest version: 5.1.7