Security · High impactFan score 44 · Tier B4 sources

Free Certified Patch for Critical Rails Active Storage Vulnerability

The Brief

A critical Active Storage flaw in Ruby on Rails lets an unauthenticated attacker write arbitrary files to a server via a crafted upload when the app processes uploads with ImageMagick.
The flaw is fixed in Rails 8.0.5.2 and 8.1.4.1.
These releases address 21 security issues in total.

Why it matters

Apps that process uploads with ImageMagick through Active Storage can have files written to their servers by unauthenticated attackers. Upgrading to a patched release closes the flaw.

Who’s affected

Rails apps processing uploads with ImageMagick/mini_magick via Active Storage

What to do

Upgrade to Rails 8.0.5.2 or Rails 8.1.4.1

Rails 8.0.5.2
Rails 8.1.4.1
#rails
#security
#active-storage
#imagemagick
#file-upload

Ruby on Rails has released security updates addressing 21 vulnerabilities, including a critical Active Storage flaw that could allow unauthenticated attackers to write arbitrary files to a server through crafted uploads. Under certain configurations, attackers may also be able to…

Read the full story at socket.dev ↗