CVE-2018-16477

Vulnerability

A bypass vulnerability in Active Storage versions >= 5.2.0 for Google Cloud Storage and Disk services allows an attacker to modify the content-disposition and content-type parameters in signed download URLs [1][2]. This can be used to serve specially crafted HTML files inline, bypassing the expected attachment disposition. Combined with cookie bombing and AppCache manifests, the attacker can gain access to private signed URLs within a specific storage path [2].

Exploitation

An attacker must obtain a signed URL (e.g., by tricking a user or leveraging a legitimate sharing mechanism) and then modify the content-disposition parameter to inline. By uploading a malicious HTML file and manipulating the URL, the attacker can have the file executed in the victim's browser. Further techniques such as cookie bombing and AppCache manifest manipulation can escalate access to other private signed URLs [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML (and potentially JavaScript) in the context of the vulnerable application, leading to cross-site scripting. Additionally, the attacker can access private signed URLs, resulting in unauthorized information disclosure of files stored under the same storage path [1][2].

Mitigation

The vulnerability is fixed in Active Storage version 5.2.1.1, released on 2018-11-30 [2]. Users should upgrade immediately. For Google Cloud Storage users, in addition to upgrading, it is recommended to update existing blobs by running ActiveStorage::Blob.find_each do |blob| blob.send :update_service_metadata end [2]. A monkey-patch workaround for GCS is also provided in the advisory [2]. No workaround is available for Disk service; upgrading is required.