3 ms·
Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people. We don’t use ActiveStorage but Claude was able create
by throwatdem12311 1mo ago
Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people.
We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell.
What a time to be alive.
- jcupitt 1mo agoThe fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running: https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier. You can block or allow specific load operations, so you can limit format support to just the types you need: https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_method https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met... That might be even better. There was a post on libvips.org about this a while ago: https://www.libvips.org/2022/05/28/What's-new-in-8.13.html https://www.libvips.org/2022/05/28/What's-new-in-8.13.html And a note about it in the checklist for devs: https://www.libvips.org/API/current/developer-checklist.html#security https://www.libvips.org/API/current/developer-checklist.html...
- rietta 1mo agoI wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.