Critical Rails Flaw Lets Attackers Write Server Files via Crafted Image Magick Uploads
Summary: Ruby on Rails disclosed a critical Active Storage flaw, rated 9.8 on the CVSS scale and tracked as GHSA-f3w6-w445-fwh9, that lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file processed through ImageMagick. The flaw was fixed in Rails 8.1.4.1 and 8.0.5.2, and an uploaded SVG reached ImageMagick's MSL coder through the analyzer that runs when a file is attached, according to the fixing commit.
Key Takeaway: Attaching the upload is enough to trigger it - no variant, preview, or analyze call is needed - and on apps using the Disk service an attacker could also read secret_key_base and credentials for other systems, opening the path to remote code execution or lateral movement. Rails reported one attack chain but said it does not assume it is the only one that exists.