Rails Active Storage + ImageMagick (GHSA-f3w6-w445-fwh9): find exposed apps, patch, and rotate secrets in 72 hours
For the Nov 4 critical Rails advisory: crafted uploads can make ImageMagick write files, and read any file (secret_key_base, credentials) on Disk-service apps. Built from the Rails advisory.
1. Inventory exposed apps2. Patch3. If you can't patch today4. Rotate secrets on Disk-service apps5. Look for abuse
Inventory exposed apps
Only apps that process untrusted uploads with ImageMagick are in scope.
- Apps with variant_processor :mini_magick, or load_defaults 6.1 or earlier with no override
- Uploads accepted from users who aren't fully trusted
- ImageMagick policy that doesn't deny MSL, Ghostscript coders and the gs delegate (Debian/Ubuntu packages don't)
Patch
Upgrade the gems, not just the base image.
- activestorage 8.0.5.2 or 8.1.4.1
- mini_magick 5.1 or later (older raises at boot)
- Re-allow gs in the host policy only if you render PDF/PostScript
If you can't patch today
Use the policy as a stopgap.
- Copy activestorage's shipped policy.xml rules into /etc/ImageMagick-*/policy.xml
- At minimum deny MSL, the PS/EPS/PDF family and the gs delegate
- Confirm with magick -list policy inside the running container
Rotate secrets on Disk-service apps
Assume anything the app process could read is exposed.
- secret_key_base and the master key (invalidates sessions and signed cookies)
- Everything in credentials.yml.enc, database and storage credentials, third-party tokens
- Don't keep old secrets as fallbacks
Look for abuse
Check recent uploads and the filesystem.
- Uploads whose content type doesn't match the extension (MSL/SVG/PS content in .jpg/.png)
- Unexpected files written under the app root, public/ or tmp/
- Use of rotated credentials after the advisory date