Technology newsroom
Urgent Alert! Rails Discovers Critical Active Storage Vulnerability, Risk of Hacking and RCE, Immediate Update Recommended
Rails has issued an urgent patch for the critical vulnerability CVE-2024-26144 in Active Storage, which could allow hackers to read sensitive server files and escalate to Remote Code Execution (RCE). All users are advised to update immediately.
📌 Key Highlights:
- Critical vulnerability found in Active Storage of Ruby on Rails (CVE-2024-26144).
- Unauthenticated attackers can read any file on the server and may escalate to Remote Code Execution (RCE).
- Rails has released patch versions 7.1.3.1, 7.0.8.1, and 6.1.7.7 to fix this. Users should update urgently.
The Ruby on Rails development team has announced an emergency security patch to fix a critical vulnerability in the Active Storage framework, a component used for managing file uploads to various cloud services such as Amazon S3, Google Cloud Storage, and Microsoft Azure Storage. This vulnerability is classified as high severity.
The vulnerability, tracked as CVE-2024-26144, is a Path Traversal flaw occurring in the DiskController, which handles file access. The problem stems from insufficient validation and filtering of data submitted in the `key` parameter, allowing malicious actors to craft URLs with special characters (e.g., `../`) to trick the system into accessing files outside the authorized directory.
💻 Impact and Attack
This attack does not require authentication and has extremely severe consequences. Attackers can read critical files on the server, such as configuration files (`database.yml`), source code, or private keys. Furthermore, in some scenarios, this vulnerability can be escalated to achieve Remote Code Execution (RCE), meaning complete server takeover, especially for applications that use Active Storage in proxy mode to serve files from third-party storage.
🛡️ Solution and Prevention
Rails has already released new versions to close this vulnerability, namely versions 7.1.3.1, 7.0.8.1, and 6.1.7.7. All developers and system administrators using Rails should check their versions and update as soon as possible. For those who cannot update immediately, it is recommended to temporarily use Rules settings to block suspicious request patterns.
💬 Who uses Ruby on Rails in their personal or company projects? Have you checked and updated this security patch yet? Feel free to share your status.