Ruby on Rails has released emergency patches for a critical vulnerability in its Active Storage framework, enabling an unauthenticated attacker to steal sensitive files and potentially take full control of affected servers.
Tracked as CVE-2024-26143, the flaw stems from insufficient content-type checks during the direct upload process. Attackers can exploit directory traversal weaknesses to read any file accessible to the web server process. The most valuable target is the secret_key_base, the cryptographic key used for signing cookies. Once an attacker forges this secret, they can elevate their access to achieve remote code execution (RCE) on the host.
Because Active Storage is a default component in modern Rails applications, the security flaw exposes a wide swath of the Ruby ecosystem. Any Rails app that accepts direct uploads is potentially vulnerable without additional custom safeguards.
The Rails maintainers have issued fixed versions for all supported branches. System administrators must upgrade immediately to one of the following releases:
- 7.1.3.2
- 7.0.8.7
- 6.1.7.7
- 6.0.7.1
If an immediate upgrade is not feasible, a temporary mitigation is available. Developers should implement a custom validator that enforces a strict allowlist of permitted MIME types for all direct uploads, blocking any requests that fail this validation.
Following patching, organizations are urged to conduct a forensic review. Examine application and system logs for indicators of compromise, such as unexpected file access patterns or anomalous activity on Active Storage endpoints. Given the attack's nature, rotating the secret_key_base and all related credentials is a prudent step if prior exploitation cannot be ruled out.
The vulnerability's two-stage attack chain—unauthenticated file read leading to credential forgery and RCE—makes it particularly severe, with a low barrier for exploitation. Security experts highlight this as a stark reminder to treat all user-input surfaces, especially file uploads, as high-risk. Adopting a defense-in-depth strategy, including rigorous patch management, least-privilege configurations, and continuous monitoring, is essential for securing Rails deployments long-term.
This urgent update closes a direct path to system compromise, and developers are strongly advised to apply the patches to safeguard their applications and data.
Ruby on Rails 就其 Active Storage 框架中的一個重大漏洞發布了緊急補丁，該漏洞允許未經授權的攻擊者竊取敏感文件，並可能完全控制受影響的伺服器。
該漏洞被編號為 CVE-2024-26143，源於直接上傳過程中對內容類型檢查不足。攻擊者可利用目錄遍歷弱點，讀取網頁伺服器進程可訪問的任何文件。最有價值的目標是 secret_key_base，這是一個用於簽署 cookies 的加密密鑰。一旦攻擊者偽造此密鑰，他們便可提升權限，實現主機上的遠端代碼執行（RCE）。
由於 Active Storage 是現代 Rails 應用程式的預設組件，此安全漏洞暴露了廣泛的 Ruby 生態系統。任何接受直接上傳的 Rails 應用程式在未採取額外自訂安全措施的情況下，均可能存在漏洞。
Rails 維護者已為所有支援的版本分支發布了修正版本。系統管理員必須立即升級至以下任一版本：
- 7.1.3.2
- 7.0.8.7
- 6.1.7.7
- 6.0.7.1
若無法立即升級，可採取臨時緩解措施。開發者應實施自訂驗證器，為所有直接上傳強制執行嚴格的 MIME 類型允許清單，並阻止任何未通過此驗證的請求。
補丁安裝後，建議組織進行取證審查。檢查應用程式和系統日誌，尋找入侵指標，例如異常的文件訪問模式或 Active Storage 端點上的異常活動。鑒於攻擊性質，若無法排除先前被利用的可能性，輪換 secret_key_base 及所有相關憑證是審慎之舉。
此漏洞的兩階段攻擊鏈——未授權文件讀取導致憑證偽造及遠端代碼執行——使其特別嚴重，且利用門檻極低。安全專家強調，這是一個明確的警示，必須將所有用戶輸入表面（尤其是文件上傳）視為高風險。採用縱深防禦策略，包括嚴格的補丁管理、最低權限配置和持續監控，對於長期保護 Rails 部署至關重要。
此次緊急更新關閉了系統被入侵的直接途徑，強烈建議開發者套用補丁以保障其應用程式和數據安全。