[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Rails security advisory GHSA-f3w6-w445-fwh9, Nov 4; no exploitation reported)

Critical Rails Active Storage flaw: a crafted image upload can make ImageMagick write files, and read any file (including secret_key_base) when attachments use the Disk service

  • You're affected if: the app uses ImageMagick through mini_magick for Active Storage (the default on load_defaults 6.1 or earlier), ImageMagick's policy doesn't already deny the coders involved (Debian and Ubuntu's packaged policies don't), and untrusted users can upload files.
  • Fix: upgrade activestorage to 8.0.5.2 / 8.1.4.1 with mini_magick 5.1 or later (older mini_magick raises an error at boot). Apps that render PDF/PostScript must re-allow the gs delegate in the host policy.
  • Can't upgrade yet: copy the shipped policy.xml rules into the system ImageMagick policy; at minimum deny the MSL coder, the Ghostscript coders and the gs delegate.
  • If attachments use the Disk service: rotate secret_key_base, the master key and everything in credentials.yml.enc, storage and database credentials and third-party tokens; don't keep the old secret as a fallback.

Sources: Rails: Possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9) · Dark Reading: Critical Rails Bug Threatens to Derail Vulnerable Servers (Nov 4)