Rails Active Storage ImageMagick Arbitrary File Read/Write Vulnerability

Active Storage in Ruby on Rails has a vulnerability that allows an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. This can expose secret_key_base and credentials, potentially leading to remote code execution or lateral movement.

ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the analyzer runs when a file is attached, so a crafted upload can invoke one. Attaching the upload is sufficient; no variant, preview, or analyze call is required.

An application is affected when it uses ImageMagick for Active Storage image processing through config.active_storage.variant_processor = :mini_magick, runs ImageMagick under a security policy that does not already deny the involved coders, and allows uploads from untrusted users.

• Affected versions: prior to 8.1.4.1 and 8.0.5.2
• Fixed versions: 8.1.4.1 and 8.0.5.2
• One specific attack chain has been reported, but other attack chains may exist