Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files.
Summary
If uploads use the Disk service, the same upload can make the server read files too.
This is a brief wire summary, the full story (linked below) has the complete details.
KazaSec's take
Stories like this are part of why proactive security testing exists, finding the gap before someone else does is always cheaper than responding after the fact.
Coverage details
We've archived 268 other articles touching the same topic (cyber security, cyber security news) , see the full security news archive.
Related security advisories
Relevant from KazaSec
More coverage on this topic
We help organizations find and fix the gaps before they make headlines.