Active Storage in Rails: Possible Arbitrary File Read and RCE
Active Storage in Rails applications is reportedly vulnerable to arbitrary file read and remote code execution due to unsafe operations in libvips not being disabled. Affected components include activestorage gem versions <=7.0.
What happened
Active Storage in Rails applications appears to have a vulnerability that may allow unauthenticated attackers to read arbitrary files and potentially execute remote code. This is reportedly due to unsafe operations in libvips not being disabled during variant processing. The vulnerability is under investigation and has been tracked under the ID GHSA-XR9X-R78C-5HRM.
To assess your exposure, check if your Rails application uses activestorage gem version <=7.0. If so, it is recommended to upgrade to activestorage gem version >=8.13 as a precaution. Additionally, change the secret_key_base and any secrets in the application environment to mitigate potential risks.
For more detailed information, consult the primary source at https://github.com/advisories/GHSA-xr9x-r78c-5hrm. The severity of this threat is high, and prompt action is advised to protect your application from possible exploitation.
How 0Day mitigates this
activestorage is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.