[deleted]
Government Rails Site Hit Hours After CVE Patch
21–30 of 41 posts
Re: Government Rails Site Hit Hours After CVE Patch
#22Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people.
We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell.
What a time to be alive.
Re: Government Rails Site Hit Hours After CVE Patch
#23Earlier quoted context omitted.
What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854 The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
> What does DHH have to do with this? DHH created Rails.
[flagged]
Re: Government Rails Site Hit Hours After CVE Patch
#24> That is about as bad as it gets and meant that any delay in patching was an existential risk of imminent compromise.
Overdramatized.
It means compromise if you delay patching and don't take the unpatched deployment offline.
Oh right, this is government sites; every second of down time is lost revenue.
Re: Government Rails Site Hit Hours After CVE Patch
#25i thought cloudflare would protect against those no?
Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.
Re: Government Rails Site Hit Hours After CVE Patch
#26Do you have to have matlab running on your rails server for this to happen?
Not running, but supported. You can check your app with: bin/rails runner ' require "vips" puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}" begin Vips::Operation.new("matload") puts "matload PRESENT - this build can reach libmatio" rescue Vips::Error puts "matload ABSENT - this build cannot reach libmatio" end ' This is from the Rails official docs for the CVE which,…
An agent skill is the official distribution format for the forensics on a 9.5. I mean, I get it, anyone running a Rails app right now is pasting "am I affected" into an agent anyway, but it's the kind of thing that would've sounded like a joke a couple years ago.
Re: Government Rails Site Hit Hours After CVE Patch
#27i thought cloudflare would protect against those no?
Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.
I agree. And unstated in this write up is the direct upload route. Even if your Cloudflare was perfect, once the attacker got the preflight they send the binary file up to S3 directly and then hit the variant route directly. The first code to “validate” the upload was the exploitable libvips code.
Re: Government Rails Site Hit Hours After CVE Patch
#28This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?
Re: Government Rails Site Hit Hours After CVE Patch
#29This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?
Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better.
We recently updated the design. This is a very old site so it has some quirks in the design for sure.
Re: Government Rails Site Hit Hours After CVE Patch
#30This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?
Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better. We recently updated the design. This is a very old site so it has some quirks in the design for sure.
Android Firefox here, top nav takes up 1/3rd of the viewport