Files or Directories Accessible to External Parties Affecting activestorage package, versions >=6.0.0.beta1, <7.2.3.2>=8.0.0.beta1, <8.0.5.1>=8.1.0.beta1, <8.1.3.1

Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties through the Vips analyzer and Vips transformer in vips.rb. An attacker can read files from the server, including process environment variables, by uploading a crafted image and causing Active Storage to process a variant or analyze it with libvips. Because unfuzzed libvips loaders and savers remained enabled, untrusted attachments could be passed to third-party operations that handle formats outside normal web images, exposing arbitrary filesystem contents and potentially secrets such as secret_key_base and external service credentials. Those secrets can be used to hijack sessions, decrypt application data, or pivot to remote code execution and lateral movement in the affected deployment.

Notes

• Only the Vips image processor is affected. Applications using Magick are not affected by this vector.
• Versions prior to 6.1.7.10 may be affected only if Active Storage has been set up outside its defaults, so a normal 6.x install isn't exposed to this vulnerability

Workarounds

• If your deployment uses libvips < 8.13, remove the ruby-vips dependency from the app’s Gemfile to stop Active Storage from using libvips at all; this avoids the vulnerable Vips analyzer/transformer path.
• If libvips >= 8.13 is installed, set VIPS_BLOCK_UNTRUSTED=true in the environment before boot to disable libvips’ unfuzzed loaders and savers and block untrusted image processing.
• If you use ruby-vips >= 2.2.1, call Vips.block_untrusted(true) from an initializer to disable unfuzzed loaders and savers during boot.
• If you do not need BMP, ICO, or PSD variants, remove image/bmp, image/vnd.microsoft.icon, and image/vnd.adobe.photoshop from config.active_storage.variable_content_types so Active Storage will not generate variants for those attachments and will fail closed on those formats.
• If you use ruby-vips only for image analysis and not for Active Storage, remove ruby-vips from the Gemfile to avoid loading libvips in the application process.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory
• Security Research
• Security Research
• PoC in GitHub