Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe content_type, bypassing any validations that rely on Active Storages automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Weakness
The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rails | Rubyonrails | * | 7.2.3.1 (excluding) |
| Rails | Rubyonrails | 8.0.0 (including) | 8.0.4.1 (excluding) |
| Rails | Rubyonrails | 8.1.0 (including) | 8.1.2.1 (excluding) |
| Rails | Ubuntu | esm-apps/xenial | * |
| Rails | Ubuntu | questing | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
- https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
- https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg