Critical Ruby on Rails Active Storage Vulnerability Allows Server File Writing via ImageMagick

A critical flaw in Ruby on Rails has been disclosed that could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file, provided the application processes uploads using ImageMagick. The vulnerability affects the Active Storage component of Ruby on Rails, which manages file uploads. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.

The issue stems from how Active Storage handles file processing. When an application configures Active Storage to use ImageMagick for processing uploaded images, a specially crafted upload can be exploited to write files outside of the intended upload directories. The disclosure notes that the severity of the impact depends on the specific server configuration and how file handling is implemented.

The Ruby on Rails project has addressed the vulnerability by releasing patched versions. Users are urged to upgrade to Ruby on Rails 8.1.4.1 or 8.0.5.2 to remediate the issue. As a defensive measure, organizations should consider disabling ImageMagick processing for untrusted uploads or evaluating alternative image processing libraries.