Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people.
We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell.
An agent skill is the official distribution format for the forensics on a 9.5. I mean, I get it, anyone running a Rails app right now is pasting "am I affected" into an agent anyway, but it's the kind of thing that would've sounded like a joke a couple years ago.
I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.
Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.
Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.
The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell.
What a time to be alive.
Overdramatized.
It means compromise if you delay patching and don't take the unpatched deployment offline.
Oh right, this is government sites; every second of down time is lost revenue.
The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
DHH created Rails.
- There was a bug with a patch
- We applied it to our clients
- There were live exploits within eight hours of the patch being released
- The Rails team had to expedite release of the technical details because POCs obviated the need to embargo