---
title: Rails Active Storage + ImageMagick (GHSA-f3w6-w445-fwh9): find exposed apps, patch, and rotate secrets in 72 hours | ctxsec
url: https://ctxsec.com/playbooks/rails-active-storage-imagemagick-72h
---

[← Playbooks](/playbooks)

# Rails Active Storage + ImageMagick (GHSA-f3w6-w445-fwh9): find exposed apps, patch, and rotate secrets in 72 hours

For the Nov 4 critical Rails advisory: crafted uploads can make ImageMagick write files, and read any file (secret_key_base, credentials) on Disk-service apps. Built from the Rails advisory.

For: Rails / platform engineers, AppSec, SOC

[1. Inventory exposed apps](#s1)[2. Patch](#s2)[3. If you can't patch today](#s3)[4. Rotate secrets on Disk-service apps](#s4)[5. Look for abuse](#s5)

1.

Step 1 of 5

__

### Inventory exposed apps

Only apps that process untrusted uploads with ImageMagick are in scope.

   - Apps with variant_processor :mini_magick, or load_defaults 6.1 or earlier with no override
   - Uploads accepted from users who aren't fully trusted
   - ImageMagick policy that doesn't deny MSL, Ghostscript coders and the gs delegate (Debian/Ubuntu packages don't)

2.

Step 2 of 5

__

### Patch

Upgrade the gems, not just the base image.

   - activestorage 8.0.5.2 or 8.1.4.1
   - mini_magick 5.1 or later (older raises at boot)
   - Re-allow gs in the host policy only if you render PDF/PostScript

3.

Step 3 of 5

__

### If you can't patch today

Use the policy as a stopgap.

   - Copy activestorage's shipped policy.xml rules into /etc/ImageMagick-*/policy.xml
   - At minimum deny MSL, the PS/EPS/PDF family and the gs delegate
   - Confirm with magick -list policy inside the running container

4.

Step 4 of 5

__

### Rotate secrets on Disk-service apps

Assume anything the app process could read is exposed.

   - secret_key_base and the master key (invalidates sessions and signed cookies)
   - Everything in credentials.yml.enc, database and storage credentials, third-party tokens
   - Don't keep old secrets as fallbacks

5.

Step 5 of 5

__

### Look for abuse

Check recent uploads and the filesystem.

   - Uploads whose content type doesn't match the extension (MSL/SVG/PS content in .jpg/.png)
   - Unexpected files written under the app root, public/ or tmp/
   - Use of rotated credentials after the advisory date

Original content by ctxsec. Printable checklist: use your browser's print view.