Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads

Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads

A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can make the server read files too. The Rails team rated the bug Critical, with a CVSS score of 9.8, and published the […]

Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store