Affected Systems
Ruby on Rails Active Storage component in all versions before 8.0.5.2 and 8.1.x before 8.1.4.1. Affects apps using ImageMagick (config.active_storage.variant_processor = :mini_magick, default for load_defaults 6.1 or earlier) that accept untrusted file uploads and lack restrictive ImageMagick policies. Debian and Ubuntu default policies do not block exploitation.
Exploitation Status
Exploitation status not disclosed. One attack chain reported via HackerOne by RyotaK (GMO Flatt Security). No public PoC confirmed, but technical details and fix commit are public.
Business Impact
CVSS 9.8 (Critical). Unauthenticated attackers can write arbitrary files to server disk and read sensitive files including secret_key_base and credentials, enabling remote code execution or lateral movement. Exploitation requires only uploading a crafted SVG file; no variant generation or preview needed. Apps using libvips (:vips processor) are not affected by this specific flaw.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade to Rails 8.1.4.1 or 8.0.5.2 immediately. Apps using :mini_magick must also upgrade mini_magick gem to 5.1 or later.
- Verify the new ImageMagick policy loaded correctly by running: bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'
- Check server's ImageMagick policy.xml for wildcard allow rules (pattern="*") that override the shipped policy blocks. Remove or restrict them.
- If immediate upgrade is not possible, manually copy rules from activestorage/lib/active_storage/image_magick/policy.xml into system ImageMagick policy (/etc/ImageMagick-7/policy.xml). At minimum, block MSL coder, Ghostscript coders, and gs delegate.
- Audit apps to confirm which use ImageMagick (check config.active_storage.variant_processor and load_defaults version). Prioritize patching internet-facing apps accepting untrusted uploads.