The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g

Summary

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

Remediation

1. Inventory every rubyonrails Active Storage deployment, including staging.
2. Upgrade rubyonrails Active Storage to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Referencehttps://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
• Referencehttps://github.com/rails/rails/releases/tag/v8.1.4.1
• Referencehttps://github.com/rails/rails/releases/tag/v8.0.5.2