Critical Rails Vulnerability Allows Arbitrary File Writes via ImageMagick Uploads

A critical vulnerability has been discovered in Ruby on Rails' Active Storage component, potentially allowing unauthenticated attackers to write arbitrary files to an application's server. This severe security issue arises when an application utilizes ImageMagick for processing uploaded files. The Rails project has acknowledged the flaw and released patches in versions 8.1.4.1 and 8.0.5.2.

The vulnerability resides within Active Storage, the part of the Rails framework responsible for handling file uploads. For applications that store uploaded files using Active Storage's Disk service, which writes files directly to the server's disk, an attacker could exploit this flaw to not only write files but also read any file accessible by the application. This could include sensitive data such as the application's secret key base and credentials for other systems, potentially leading to remote code execution or lateral movement within the network.

With a CVSS score of 9.8 out of 10, this flaw is rated as critical. It is currently tracked as GHSA-f3w6-w445-fwh9 and does not yet have an assigned CVE identifier. The exploitation relies on how ImageMagick selects a format handler, or 'coder,' based on a file's content. Some of these coders can act on other files referenced within an image rather than the image itself. Active Storage's default configuration does not sufficiently restrict which coders can be used, making the server's ImageMagick security policy the primary defense.

The vulnerability is triggered when an uploaded file, such as a specially crafted SVG, is analyzed by ImageMagick's MSL (Magick Scripting Language) coder. MSL is a scripting coder capable of reading and writing files specified within its script. The analysis occurs automatically when a file is attached via Active Storage, meaning the application does not need to perform further actions like creating variants or previews to reach the vulnerable code path.

Rails has indicated that at least one attack chain has been reported, but they caution that this may not be the only method of exploitation. The advisory does not specify whether the vulnerability has been actively exploited in the wild. The issue was reported through HackerOne by researcher RyotaK from GMO Flatt Security.

An application is only vulnerable if it meets three specific criteria: it must use ImageMagick for Active Storage image processing (typically configured via config.active_storage.variant_processor = :mini_magick), its ImageMagick security policy must not already block the implicated coders (policies shipped by Debian and Ubuntu are noted as insufficient), and it must accept file uploads from untrusted users. Applications using Rails versions prior to 8.0.5.2 and 8.1 versions prior to 8.1.4.1 are affected, with older release series no longer receiving support.

To mitigate this risk, Rails strongly recommends upgrading to the patched versions (8.1.4.1 or 8.0.5.2). These updates include an enhanced ImageMagick security policy that blocks dangerous coders like MSL and those relying on Ghostscript. Additionally, users should ensure their ImageMagick configuration is correctly applying this policy. For those unable to upgrade immediately, applying the policy rules manually to ImageMagick's system configuration or using specific workarounds is advised. This vulnerability follows a separate critical Active Storage flaw fixed in July that affected apps using libvips.