Government Rails Site Hit Hours After CVE Patch

Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.

Re: Government Rails Site Hit Hours After CVE Patch

#6

Post by rietta » Fri, Sep 04, 2026, 7:45 PM UTC

comrade1234 wrote: post #3

Do you have to have matlab running on your rails server for this to happen?

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

Re: Government Rails Site Hit Hours After CVE Patch

#7

Post by kawsper » Fri, Sep 04, 2026, 7:56 PM UTC

rietta wrote: post #6

comrade1234 wrote: post #3

Do you have to have matlab running on your rails server for this to happen?

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted:

    vips -l
    VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load

Re: Government Rails Site Hit Hours After CVE Patch

#8

Post by bradly » Fri, Sep 04, 2026, 7:57 PM UTC

comrade1234 wrote: post #3

Do you have to have matlab running on your rails server for this to happen?

Not running, but supported. You can check your app with:

    bin/rails runner '
      require "vips"
      puts "ruby-vips #{Vips::VERSION}  libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
      begin
        Vips::Operation.new("matload")
        puts "matload PRESENT - this build can reach libmatio"
      rescue Vips::Error
        puts "matload ABSENT - this build cannot reach libmatio"
      end
    '

This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob...

Re: Government Rails Site Hit Hours After CVE Patch

#9

Post by rietta » Fri, Sep 04, 2026, 8:00 PM UTC

kawsper wrote: post #7

rietta wrote: post #6

Earlier quoted context omitted.

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted: vips -l VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load

Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.

Re: Government Rails Site Hit Hours After CVE Patch

#10

Post by fishtoaster » Fri, Sep 04, 2026, 8:05 PM UTC

comrade1234 wrote: post #3

Do you have to have matlab running on your rails server for this to happen?

I think the answer is no - this would affect any Rails app with default settings that uses ActiveStorage. The "Preconditions" recap at the bottom here has all the appropriate caveats: https://ethiack.com/info-hub/research/kindarails2shell-how-a...