Ruby on Rails'dagi jiddiy zaiflik, agar ilova yuklamalarni ImageMagick yordamida qayta ishlasa, autentifikatsiyasiz hujumchiga ilova serverida ixtiyoriy fayllarni yozish imkonini berishi mumkin. Rails loyihasi zaiflikni e'lon qildi va uni 8.1.4.1 va 8.0.5.2 versiyalarida tuzatdi.
Zaiflik Active Storage'da — Rails'dagi fayl yuklamalarini boshqaradigan qismda. Ba'zi ilovalar yuklangan fayllarni Active Storage'ning Disk xizmati yordamida saqlaydi, bu ularni server diskida saqlaydi. Bunday ilovalarda hujumchi ilova o'qiy oladigan har qanday faylni ham o'qishi mumkin.
Rails'ga ko'ra, bu fayllar odatda ilovaning secretkeybase va boshqa tizimlar uchun ma'lumotlarini o'z ichiga oladi. Ularni o'qish, o'z navbatida, masofaviy kod bajarish yoki shu tizimlarga lateral harakatlanish imkonini berishi mumkin.
Rails zaiflikni CVSS shkalasi bo'yicha 10 dan 9,8 deb baholaydi. U GHSA-f3w6-w445-fwh9 sifatida kuzatiladi va hali CVE identifikatoriga ega emas.
ImageMagick fayl mazmuniga asoslanib format ishlovchisini (coder deb ataladi) tanlaydi. Ba'zi coder'lar rasmning o'ziga emas, balki rasm ichida nomlangan boshqa fayllarga ta'sir qiladi. Active Storage yuklamada qaysi coder'lar ishlatilishi mumkinligi bo'yicha hech qanday cheklov qo'ymaydi, shuning uchun serverning o'z ImageMagick siyosati yagona cheklov edi.
Active Storage'dagi ImageMagick analizatori fayl biriktirilganda ishlaydi. Yuklamani biriktirish zaiflikka yetish uchun yetarli. Ilova variant (rasmning o'zgartirilgan nusxasi) yoki oldindan ko'rinish yaratishi, yoki analyze chaqirishi shart emas.
Yuklangan SVG fayli shu analizator orqali ImageMagick'ning MSL coder'iga yetgan, zaiflikni tuzatgan commit'ga ko'ra. MSL — skript tomonidan nomlangan fayllarni o'qiydigan va yozadigan skript coder.
Rails'ga ko'ra, bitta hujum zanjiri xabar qilingan, lekin u "faqat shu bitta mavjud deb o'ylamaydi". E'lon zaiflikdan foydalanilganmi yoki yo'qmi, aytmaydi.
Zaiflik GMO Flatt Security'dagi tadqiqotchi RyotaK tomonidan HackerOne orqali xabar qilingan.
Qaysi Rails Ilovalari Ta'sirlangan
Ilova faqat quyidagi uchta shartning barchasi to'g'ri bo'lsa ta'sirlanadi:
- U Active Storage rasm qayta ishlash uchun ImageMagick'dan foydalanadi. Bu
config.active_storage.variant_processor = :mini_magicksozlamasi,load_defaults 6.1yoki undan oldingi ilovalar uchun standart. - Uning ImageMagick xavfsizlik siyosati allaqachon tegishli coder'larni bloklamaydi. Rails'ga ko'ra, Debian va Ubuntu tarqatadigan siyosatlar bunday emas.
- U ishonchsiz foydalanuvchilardan fayl yuklamalarini qabul qiladi.
Birinchi shartni tekshirish uchun config.active_storage.variant_processor ga qarang. Agar u o'rnatilmagan bo'lsa, standart load_defaults ga bog'liq: 7.0 dan oldin :mini_magick, 7.0 dan boshlab :vips. Xuddi shu sozlama qaysi kutubxona yuklamalarni tahlil qilishini ham belgilaydi, faqat variantlar yaratadigan kutubxona emas.
8.0.5.2 dan oldingi har bir Active Storage versiyasi ta'sirlangan, shuningdek 8.1.4.1 dan oldingi 8.1 versiyalari. 8.0 dan eski reliz seriyalari endi qo'llab-quvvatlanmaydi va Rails ular uchun tuzatilgan versiyalarni chiqarmaydi.
Iyulda Rails boshqa jiddiy Active Storage zaifligi — CVE-2026-66066 ni tuzatdi, bu ImageMagick o'rniga libvips ishlatadigan ilovalarga ta'sir qildi. ImageMagick ishlatadigan ilovalar o'sha zaiflikning hujum yo'liga duchor emas edi, lekin ular bu zaiflikka duchor bo'lishi mumkin.
Xuddi shu relizlar ikkinchi Active Storage zaifligini ham tuzatadi — GHSA-v924-7rp8-4mxh, Rails uni yuqori deb baholaydi va CVSS balli 8,8. Active Storage yuklamalarni ImageMagick va FFmpeg'ga vaqtinchalik fayl nomlari bilan yuborgan, bu yuklangan faylning kengaytmasini saqlab qolgan.
Bu vositalar fayl mazmuni formatini ko'rsatmasa, kengaytmadan dekoder tanlashi mumkin. Shunday qilib, yuklamaning fayl nomini tanlagan va mazmun turini e'lon qilgan hujumchi uni qayta ishlaydigan dekoderni tanlashi mumkin.
Nima Qilish Kerak
Rails iloji boricha tezroq yangilashni qat'iy tavsiya qiladi. Ikki reliz jami 21 ta xavfsizlik muammosini tuzatadi.
Tuzatilgan versiyalar ImageMagick xavfsizlik siyosatini o'z ichiga oladi. MiniMagick — Active Storage ImageMagick'ni chaqirish uchun ishlatadigan Ruby gem. Uning standart sozlamasida, u ishlatadigan har bir ImageMagick buyrug'i siyosatni qo'llaydi, faqat Active Storage'dan kelgan buyruqlar emas.
Siyosat MSL coder'ni; rasm emas, boshqa fayllarni o'qiydigan yoki o'chiradigan coder'larni; masofaviy yoki mahalliy havolalarni olish yoki ularni ekranda ko'rsatadigan coder'larni; Ghostscript bilan bog'liq har bir coder'ni, shuningdek gs delegatini; va @filename yo'naltirishni bloklaydi.
- Rails 8.1.4.1 yoki 8.0.5.2 ga yangilang.
:mini_magickishlatadigan ilovalar mini_magick 5.1 yoki undan keyingi versiyasini ham talab qiladi, aks holda yuklashda xato beradi. Rails 8.0 xavfsizlik tuzatishlarini faqat 2026-yil 7-noyabrgacha oladi, texnik xizmat ko'rsatish siyosatiga ko'ra. - Ilova yangi siyosatni yuklayotganini tasdiqlang, Active Storage qo'llanmasida tasvirlanganidek,
bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'buyrug'ini ishga tushirish orqali. - Yetkazilgan siyosat ilovaga umuman yetib borishini tekshiring. U
MiniMagick.cli_envni yuklashdan keyin almashtiradigan,MiniMagick.cli_prefixbilan muhitni tozalaydigan yoki o'zMiniMagick::Shellni o'rnatadigan ilovaga yetib bormaydi. Bunday ilova qoidalarni ImageMagick tizim siyosatiga joylashtirishi kerak. - GraphicsMagick ishlatadigan ilovalar yetkazilgan siyosatdan himoya olmaydi, chunki GraphicsMagick ImageMagick siyosatlarini o'qimaydi.
- Serverning o'z ImageMagick siyosatini tekshiring. Yetkazilgan siyosat uni almashtirmaydi, balki unga qo'shiladi. U yerda coder'ni ruxsat beradigan qoida, jumladan
pattern="*"kabi wildcard, yetkazilgan siyosatning o'sha coder'ni bloklashini bekor qiladi. - Agar ilova PDF yoki PostScript fayllarini ImageMagick orqali ko'rsatsa, serverning
policy.xmldagsdelegatini va u ishlatadigan coder'larni qayta ruxsat bering. - Agar hozircha yangilay olmasangiz, yetkazilgan siyosat qoidalarini,
activestorage/lib/active_storage/image_magick/policy.xml, ImageMagick tizim siyosatiga, masalan/etc/ImageMagick-7/policy.xml, nusxalang. Kamida MSL coder'ni, Ghostscript coder'larini vagsdelegatini bloklang. Rails shuningdek 8.1 va 8.0 uchun tuzatishlarni patch sifatida e'lon qildi. - 8.0 dan eski reliz seriyalaridagi ilovalar bu yechimni ishlatishi yoki 8.0 yoki undan keyingi versiyaga yangilashi mumkin.
- Rails'ning ikkinchi zaiflik uchun yechimlari faqat FFmpeg qanday ishlatilishini o'zgartiradi. Ularning hech biri ImageMagick'ni qamrab olmaydi.
- Agar ilova biriktirmalarni Disk xizmati bilan saqlasa,
secret_key_baseva ilova jarayoni o'qiy oladigan har qanday boshqa maxfiy ma'lumotni o'zgartiring. Bu master kalit,config/credentials.yml.encda saqlanadigan hamma narsa, saqlash va ma'lumotlar bazasi ma'lumotlari va uchinchi tomon tokenlarini o'z ichiga oladi. Fosh qilingan maxfiy ma'lumotni zaxira sifatida saqlamang.
E'lon ilova allaqachon nishonga olinganini tekshirish usulini tushuntirmaydi.
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.
The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store uploaded files using Active Storage's Disk service, which stores them on the server's disk. In those apps, an attacker could also read any file the app can read.
Those files typically include the app's secretkeybase and its credentials for other systems, according to Rails. Reading them may in turn allow remote code execution or lateral movement into those systems.
Rails rates the flaw 9.8 out of 10 on the CVSS scale. It is tracked as GHSA-f3w6-w445-fwh9 and does not yet have a CVE identifier.
ImageMagick selects a format handler, which it calls a coder, based on the file's content. Some coders act on other files named inside the image, not on the image itself. Active Storage imposes no limits on which coders an upload can use, so the server's own ImageMagick policy was the only limit.
The ImageMagick analyzer in Active Storage runs when a file is attached. Attaching the upload is enough to reach the flaw. The app does not have to make a variant (a transformed copy of the image) or a preview, or call analyze.
An uploaded SVG file reached ImageMagick's MSL coder through that analyzer, according to the commit that fixed the flaw. MSL is a scripting coder that reads and writes files named by its script.
Rails said one attack chain was reported to it, but it does "not assume it is the only one that exists." The advisory does not say whether the flaw has been exploited.
The flaw was reported through HackerOne by RyotaK, a researcher at GMO Flatt Security.
Which Rails Apps Are Affected
An app is affected only if all three of these are true:
- It uses ImageMagick for Active Storage image processing. That is the setting
config.active_storage.variant_processor = :mini_magick, the default for apps onload_defaults 6.1or earlier. - Its ImageMagick security policy does not already block the coders involved. Rails says the policies that Debian and Ubuntu ship do not.
- It accepts file uploads from untrusted users.
To check the first condition, look at config.active_storage.variant_processor. If it is not set, the default depends on load_defaults: :mini_magick before 7.0, and :vips from 7.0 on. The same setting decides which library analyzes uploads, not only which one makes variants.
Every Active Storage version before 8.0.5.2 is affected, as are 8.1 versions before 8.1.4.1. Release series older than 8.0 are no longer supported, and Rails will not release fixed versions for them.
In July, Rails fixed a different critical Active Storage flaw, CVE-2026-66066, which affected apps that use libvips instead of ImageMagick. Apps using ImageMagick were not exposed to that flaw's attack path, but they can be exposed to this one.
The same releases fix a second Active Storage flaw, GHSA-v924-7rp8-4mxh, which Rails rates high with a CVSS score of 8.8. Active Storage passed uploads to ImageMagick and FFmpeg under temporary file names that kept the uploaded file's extension.
Those tools can pick a decoder from the extension when a file's content does not show its format. So an attacker who chose an upload's filename and declared its content type could choose the decoder that processes it.
What to Do
Rails strongly recommends upgrading as soon as possible. The two releases fix 21 security issues in total.
The fixed versions ship an ImageMagick security policy. MiniMagick is the Ruby gem Active Storage uses to call ImageMagick. In its default setup, every ImageMagick command it runs applies the policy, not only commands from Active Storage.
The policy blocks the MSL coder; coders that read or delete files other than the image; coders that fetch remote or local references or display them on a screen; every coder backed by Ghostscript, along with the gs delegate; and @filename indirection.
- Upgrade to Rails 8.1.4.1 or 8.0.5.2. Apps on
:mini_magickalso need mini_magick 5.1 or later, or they raise an error at boot. Rails 8.0 gets security fixes only until November 7, 2026, under its maintenance policy. - Confirm that the app loads the new policy, as the Active Storage guide describes, by running
bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'. - Check whether the shipped policy reaches the app at all. It does not reach an app that replaces
MiniMagick.cli_envafter boot, clears the environment withMiniMagick.cli_prefix, or installs its ownMiniMagick::Shell. Such an app must put the rules in ImageMagick's system policy. - Apps that use GraphicsMagick get no protection from the shipped policy, because GraphicsMagick does not read ImageMagick policies.
- Check the server's own ImageMagick policy. The shipped policy adds to it rather than replacing it. A rule there that allows a coder, including a wildcard such as
pattern="*", overrides the shipped policy's block on that coder. - If the app renders PDF or PostScript files through ImageMagick, re-allow the
gsdelegate and the coders it uses in the server'spolicy.xml. - If you cannot upgrade yet, copy the rules of the shipped policy,
activestorage/lib/active_storage/image_magick/policy.xml, into ImageMagick's system policy, such as/etc/ImageMagick-7/policy.xml. At a minimum, block the MSL coder, the Ghostscript coders, and thegsdelegate. Rails also published the fix as patches for 8.1 and 8.0. - Apps on release series older than 8.0 can use that workaround or upgrade to 8.0 or later.
- Rails' workarounds for the second flaw only change how FFmpeg is used. None of them covers ImageMagick.
- If the app stores attachments with the Disk service, change
secret_key_baseand every other secret the app process can read. That includes the master key, everythingconfig/credentials.yml.encholds, storage and database credentials, and third-party tokens. Do not keep an exposed secret as a fallback.
The advisory does not explain how to check whether an app has already been targeted.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.