Critical Ruby on Rails Flaw Allows Arbitrary File Writes via ImageMagick Uploads
· Cybersecurity
The Ruby on Rails project disclosed a critical flaw in Active Storage's ImageMagick integration that allows an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file, and potentially read sensitive files. The flaw was fixed in Rails versions 8.1.4.1 and 8.0.5.2. Attackers could use the file write to position themselves for lateral movement within the affected environment. Rails is a widely used web application framework, so the vulnerability affects many production applications that process user uploads through ImageMagick. Administrators should upgrade to the fixed versions promptly.
Why it matters：Rails powers a large share of web applications, so a critical file-write flaw in its upload pipeline puts many production servers at risk of compromise and lateral movement.
Key points
- The flaw is in Active Storage's ImageMagick integration.
- Fixed in Rails versions 8.1.4.1 and 8.0.5.2.
- An unauthenticated attacker can write arbitrary files via crafted uploads.
Sources (original reporting)
More stories from this day
- Crédit Mutuel Arkéa Confirms $133 Million Cyber Heist
- Asian Airlines Report Data Breaches Tied to Amadeus IT Provider
- Zyxel Patches Zero-Day Exploited Against Nearly 1,000 Switches
- Cyberattack Disrupts Blood Storage Refrigeration at French Facilities
- US voters reject data center measures as Democrats sweep midterms
- US stocks post best day since August as Democrats sweep midterms