Like 0
Fork 0

Last active 2 weeks ago

CVE-2026-66066.md Raw

CVE-2026-66066

This is a vulnerability affecting all OTW Archive forks. The original OTW Archive is currently vulnerable. Immediate action is required to protect user data and prevent potential system compromise.

Severity: CRITICAL (CVSS 9.5/10)
Vulnerability: Arbitrary File Read & Remote Code Execution
Affected: All OTW Archive forks using Rails 8.1.0 or earlier with Active Storage + libvips

Vulnerability Check

Run these commands to check if your system is vulnerable:

# Check Rails version (should be 8.1.3.1 or higher)
bundle exec rails -v

# Check Puma version (should be 8.0.2 or higher)  
bundle exec puma -V

# Check libvips version (should be 8.13 or higher)
vips --version

# Check ruby-vips version (should be 2.2.1 or higher)
bundle exec ruby -e 'require "vips"; puts Vips.version_string'

# Run security audit to see all vulnerabilities
bundle exec bundler-audit check --update

If any versions are below the required levels, your system is vulnerable, and needs immediate patching.

What is CVE-2026-66066?

"KindaRails2Shell" is a critical vulnerability that allows unauthenticated attackers to:

  • Read any file on the server (secrets, credentials, API keys)
  • Achieve Remote Code Execution (RCE)
  • Escalate to lateral movement to other systems
  • Potentially compromise cloud infrastructure

Attack Vector: Upload a crafted image file → trigger variant processing → read arbitrary files

Impact: 500,000+ estimated sites affected

Current Vulnerability Status

Component OTW Archive (Current) Required Status
Rails 8.1.0 8.1.3.1 ❌ VULNERABLE
Puma 6.5.0 8.0.2 ❌ VULNERABLE

Required Upgrades

1. Update Gemfile

# Critical security updates
gem "rails", "~> 8.1.3.1"
gem "puma", "~> 8.0.2"
gem "ruby-vips", ">= 2.2.1"

# Additional security fixes (recommended)
gem "concurrent-ruby", ">= 1.3.7"
gem "nokogiri", ">= 1.19.4"
gem "faraday", ">= 2.14.3"
gem "websocket-driver", ">= 0.8.2"
gem "loofah", ">= 2.25.2"
gem "net-imap", ">= 0.6.4.1"
gem "crass", ">= 1.0.7"
gem "json", ">= 2.19.9"
gem "rails-html-sanitizer", ">= 1.7.1"

2. Remove Duplicate Dependencies

If you have duplicate nokogiri entries, remove the older one:

# Remove this line if you have the security version above
gem 'nokogiri', '>= 1.8.5'

3. Add Security Initializer

Create config/initializers/vips_security.rb:

# Security initializer to block untrusted libvips operations
# This mitigates CVE-2026-66066
if defined?(Vips)
  if Vips.at_least_libvips?(8, 13) && Vips.respond_to?(:block_untrusted)
    Vips.block_untrusted(true)
    Rails.logger.info "VIPS_BLOCK_UNTRUSTED: Enabled - Untrusted libvips operations blocked"
  else
    Rails.logger.warn "VIPS_BLOCK_UNTRUSTED: Cannot enable - libvips >= 8.13 or ruby-vips >= 2.2.1 required"
  end
end

4. Fix PhraseApp Compatibility (if using PhraseApp)

Update config/initializers/monkeypatches/fix_phraseapp.rb:

if defined?(PhraseApp::VERSION) && PhraseApp::VERSION == "1.6.0"
  PhraseApp::InContextEditor::BackendService.prepend(FixPhraseapp)
else
  puts "WARNING: The monkeypatch #{__FILE__} was written for version 1.6.0 of the phraseapp-in-context-editor-ruby gem, but you are running #{defined?(PhraseApp::VERSION) ? PhraseApp::VERSION : 'unknown version'}. Please update or remove the monkeypatch."
end

Comment out config/initializers/phraseapp_in_context_editor.rb (API changed in v3.x):

# PhraseApp::InContextEditor.configure do |config|
#   # ... configuration commented out ...
# end

5. Update Bundle

bundle update

6. Verify libvips Version

# Check system libvips version
vips --version  # Should be >= 8.13

# Or check via Ruby
bundle exec ruby -e 'require "vips"; puts Vips.version_string'

7. Restart Application

# If using Docker
docker restart <web-container>

# Or restart your web server

Additional Security Vulns

  • Puma (2 CVEs): PROXY Protocol DoS vulnerabilities
  • concurrent-ruby (3 CVEs): Livelocks and lock corruption
  • nokogiri (9 vulnerabilities): Memory safety issues
  • websocket-driver (4 CVEs): DoS vulnerabilities
  • faraday (2 CVEs): Stack exhaustion DoS
  • loofah: SVG href bypass
  • net-imap (3 CVEs): Command injection
  • crass (4 CVEs): CSS parsing DoS
  • json: Heap buffer overflow
  • rails-html-sanitizer: XSS vulnerability

Post-Patch

1. Rotate All Secrets

After patching, immediately rotate:

  • secret_key_base
  • Database credentials
  • API keys (SendGrid, AWS, etc.)
  • Session tokens
  • Any other credentials in environment variables

2. Check for Compromise

Review logs for suspicious activity around image uploads.

Also, set up monitoring for unusual file access or system behavior.

Verification

After applying fixes, verify:

# Check Rails version
bundle exec rails -v  # Should be 8.1.3.1

# Check Puma version  
bundle exec puma -V  # Should be 8.0.2

# Check libvips security
bundle exec ruby -e 'require "vips"; puts Vips.at_least_libvips?(8, 13); puts Vips.respond_to?(:block_untrusted)'

# Run security audit
bundle exec bundler-audit check

References

Please share this with all OTW Archive fork operators.

Powered by Opengist ⋅ Load: 17ms⋅

English