Overview
Ruby on Rails (often called Rails) is a web application framework written in Ruby that emphasizes convention over configuration and the principle of "don't repeat yourself" (DRY). It provides developers with a structured and efficient way to build database-backed web applications through pre-built patterns for rapid development.
Rails applications that use Active Storage, image_processing and the mini_magick backend may be vulnerable to a code injection exploit.
Remote code execution flaws are among the Top 10 Open Web Application Security Project (OWASP) vulnerabilities. They are among the most potentially damaging of vulnerabilities because injected, remotely executed code:
- can access internal application objects/methods
- can often bypass security controls
- may persist across sessions
- can often pivot to gain OS-level access.
All users running an affected release should apply the workaround or upgrade immediately.
Details
Module Info
- Product: Ruby on Rails Framework
- Affected packages: activestorage
- GitHub repository:
https://github.com/rails/rails - Published package: The individual activestorage gem or the entire Rails Framework gem (which includes activestorage).
- Package manager: gem
Vulnerability Info
When untrusted user input is passed as the transformation method or transformation arguments, it may be possible to execute code remotely.
Steps to Reproduce
Vulnerable code will look similar to this:
<%= image_tag blob.variant(params[:t] => params[:v]) %>
Where the transformation method or its arguments are untrusted arbitrary input.
Workarounds
If upgrading immediately is not possible, applications should implement a strict allow-list on accepted transformation methods or arguments, such as the following:
class TransformationsController < ApplicationController
def apply
method = params[:method]
value = params[:value]
# Define an allow-list of permitted methods
allowed_methods = {
"rotate" => :rotate,
"scale" => :scale,
"flip" => :flip
}
end
Also consider implementing a strict Image Magick security policy (see https://imagemagick.org/script/security-policy.php).
Credits
- Thanks to gquadros_ for reporting this and Zack Deveau of Shopify for writing the patches.
Mitigation
Users of affected versions of Ruby on Rails should follow one of the following mitigations:
- Upgrade to a corrected version.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
