Top Highlights
- Attackers can exploit a vulnerability in Active Storage with Vips image processing to perform arbitrary file reads, potentially exposing sensitive Rails secrets like signing material.
- By reusing signed variation keys and crafting malicious MAT/HDF5 files, attackers can bypass content-type checks and trigger remote code execution via libvips, Kernel#spawn, or Kernel#eval.
- The flaw enables recovering critical environment secrets, leading to complete server compromise, including remote code execution and data exfiltration, without requiring access to the Rails secret key.
Threat, Attack Techniques, and Targets
Rapid7’s analysis details a vulnerability called KindaRails2Shell, affecting Active Storage in Ruby on Rails applications that use the Vips image processor with untrusted uploads (CVE-2026-66066). Attackers can exploit this flaw to read arbitrary files from the server. They achieve this by submitting a crafted image file that reaches the libvips loader, which mishandles the file and allows reading sensitive data. The attack starts when the attacker creates a direct-upload blob with a trusted content type, like image/png. Then, they reuse a valid variation key and trigger the image processing chain. This chain involves libvips loading a crafted MAT or HDF5 file that can trick the system into exposing server files. The targets include sensitive files such as Rails signing material, environment variables, or other server secrets. The flaw affects Rails 7.0 and later when Vips is the default processor, and also Rails 6 in specific configurations.
Impact, Security Implications, and Remediation Guidance
The vulnerability’s impact is significant. An attacker can read arbitrary files on the server before recovering any secret or forging tokens. This can lead to retrieving secrets like SECRET_KEY_BASE and RAILS_MASTER_KEY, which can enable further attacks such as remote code execution. The flaw arises because untrusted uploads are passed directly to libvips for processing, which mishandles crafted MAT/HDF5 files. Fortunately, fixes have been released. The patched versions of Active Storage block untrusted libvips operations during initialization and require libvips 8.13+ and ruby-vips 2.2.1+. For remediation, it is advised to update to the latest Active Storage releases and ensure libvips and ruby-vips are upgraded accordingly. Official guidance should be obtained from the Rails security advisory and Rapid7’s Emergent Threat Response blog.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
