Arbitrary file read and remote code execution in Active Storage
9 hours ago
- A Rails application using Active Storage with image variants may allow unauthenticated attackers to read arbitrary files, including secret_key_base and credentials, potentially leading to remote code execution.
- The vulnerability stems from libvips' unfuzzed operations not being disabled by Active Storage, allowing attackers to invoke them via crafted file uploads.
- Affected applications use libvips for image processing (config.active_storage.variant_processor = :vips) and allow image uploads from untrusted users.
- Mitigation requires upgrading activestorage to fixed versions, upgrading libvips to >= 8.13, and changing all exposed secrets such as secret_key_base and credentials.
- If libvips < 8.13, no workarounds exist besides removing libvips; for libvips >= 8.13, unfuzzed operations can be blocked via environment variable or Ruby code.
- Secrets must be fully replaced (not just rotated) as exfiltration may have already occurred; upgrading only prevents future exploitation.