GitHub Advisoryadvisory · RubyGems

GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage

CRITICAL Published 2022-03-08 Modified 2022-06-21 Official page ↗
Aliases
CVE-2022-21831
Ecosystem
RubyGems
Packages
activestorage
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-03-08

Affected packages

• RubyGems activestorage: >= 5.2.0, < 5.2.6.3 → fixed in 5.2.6.3 • RubyGems activestorage: >= 6.0.0, < 6.0.4.7 → fixed in 6.0.4.7 • RubyGems activestorage: >= 6.1.0, < 6.1.4.7 → fixed in 6.1.4.7 • RubyGems activestorage: >= 7.0.0, < 7.0.2.3 → fixed in 7.0.2.3

Description

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments. Additionally, a strict ImageMagick security policy will help mitigate this issue.

Related

Alias · CVE (1)

  • CVE-2022-21831 A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References