Critical Rails flaw lets unauthenticated attackers write files via crafted ImageMagick uploads

Apps are exposed only if their ImageMagick policy does not already block the risky coders, which Rails says is true of the Debian and Ubuntu defaults.

Rails has patched a critical Active Storage flaw, rated 9.8 by its maintainers, that lets an unauthenticated attacker write arbitrary files to a server when an app runs uploads through ImageMagick. Attaching a crafted upload is enough to trigger it, and where the Disk service is used the attacker can also read server files, potentially including secret_key_base and stored credentials. Fixed releases are 8.1.4.1 and 8.0.5.2, which ship an ImageMagick policy blocking the risky coders. The exposure depends on the app's configuration, since apps whose ImageMagick policy already blocks these coders are not exposed, and Rails states that the Debian and Ubuntu policies do not block them. Rails says it knows of one attack chain but does not assume it is the only one, and it has not said whether the flaw has been exploited.