# CVE-2026-66066

This is a vulnerability affecting all OTW Archive forks. The original OTW Archive is currently vulnerable. Immediate action is required to protect user data and prevent potential system compromise.

Severity: CRITICAL (CVSS 9.5/10)  
Vulnerability: Arbitrary File Read & Remote Code Execution  
Affected: All OTW Archive forks using Rails 8.1.0 or earlier with Active Storage + libvips

## Vulnerability Check

Run these commands to check if your system is vulnerable:

```bash
# Check Rails version (should be 8.1.3.1 or higher)
bundle exec rails -v

# Check Puma version (should be 8.0.2 or higher)  
bundle exec puma -V

# Check libvips version (should be 8.13 or higher)
vips --version

# Check ruby-vips version (should be 2.2.1 or higher)
bundle exec ruby -e 'require "vips"; puts Vips.version_string'

# Run security audit to see all vulnerabilities
bundle exec bundler-audit check --update
```

**If any versions are below the required levels, your system is vulnerable, and needs immediate patching.**

## What is CVE-2026-66066?

["KindaRails2Shell"](https://www.herodevs.com/blog-posts/cve-2026-66066-rails-active-storage-arbitrary-file-read-and-rce) is a critical vulnerability that allows unauthenticated attackers to:

- Read any file on the server (secrets, credentials, API keys)
- Achieve Remote Code Execution (RCE)
- Escalate to lateral movement to other systems
- Potentially compromise cloud infrastructure

Attack Vector: Upload a crafted image file → trigger variant processing → read arbitrary files

Impact: 500,000+ estimated sites affected

## Current Vulnerability Status

| Component | OTW Archive (Current) | Required | Status       |
| --------- | --------------------- | -------- | ------------ |
| Rails     | 8.1.0                 | 8.1.3.1  | ❌ VULNERABLE |
| Puma      | 6.5.0                 | 8.0.2    | ❌ VULNERABLE |

## Required Upgrades

### 1. Update Gemfile

```ruby
# Critical security updates
gem "rails", "~> 8.1.3.1"
gem "puma", "~> 8.0.2"
gem "ruby-vips", ">= 2.2.1"

# Additional security fixes (recommended)
gem "concurrent-ruby", ">= 1.3.7"
gem "nokogiri", ">= 1.19.4"
gem "faraday", ">= 2.14.3"
gem "websocket-driver", ">= 0.8.2"
gem "loofah", ">= 2.25.2"
gem "net-imap", ">= 0.6.4.1"
gem "crass", ">= 1.0.7"
gem "json", ">= 2.19.9"
gem "rails-html-sanitizer", ">= 1.7.1"
```

### 2. Remove Duplicate Dependencies

If you have duplicate nokogiri entries, remove the older one:
```ruby
# Remove this line if you have the security version above
gem 'nokogiri', '>= 1.8.5'
```

### 3. Add Security Initializer

Create `config/initializers/vips_security.rb`:
```ruby
# Security initializer to block untrusted libvips operations
# This mitigates CVE-2026-66066
if defined?(Vips)
  if Vips.at_least_libvips?(8, 13) && Vips.respond_to?(:block_untrusted)
    Vips.block_untrusted(true)
    Rails.logger.info "VIPS_BLOCK_UNTRUSTED: Enabled - Untrusted libvips operations blocked"
  else
    Rails.logger.warn "VIPS_BLOCK_UNTRUSTED: Cannot enable - libvips >= 8.13 or ruby-vips >= 2.2.1 required"
  end
end
```

### 4. Fix PhraseApp Compatibility (if using PhraseApp)

Update `config/initializers/monkeypatches/fix_phraseapp.rb`:
```ruby
if defined?(PhraseApp::VERSION) && PhraseApp::VERSION == "1.6.0"
  PhraseApp::InContextEditor::BackendService.prepend(FixPhraseapp)
else
  puts "WARNING: The monkeypatch #{__FILE__} was written for version 1.6.0 of the phraseapp-in-context-editor-ruby gem, but you are running #{defined?(PhraseApp::VERSION) ? PhraseApp::VERSION : 'unknown version'}. Please update or remove the monkeypatch."
end
```

Comment out `config/initializers/phraseapp_in_context_editor.rb` (API changed in v3.x):
```ruby
# PhraseApp::InContextEditor.configure do |config|
#   # ... configuration commented out ...
# end
```

### 5. Update Bundle

```bash
bundle update
```

### 6. Verify libvips Version

```bash
# Check system libvips version
vips --version  # Should be >= 8.13

# Or check via Ruby
bundle exec ruby -e 'require "vips"; puts Vips.version_string'
```

### 7. Restart Application

```bash
# If using Docker
docker restart <web-container>

# Or restart your web server
```

## Additional Security Vulns

- Puma (2 CVEs): PROXY Protocol DoS vulnerabilities
- concurrent-ruby (3 CVEs): Livelocks and lock corruption  
- nokogiri (9 vulnerabilities): Memory safety issues
- websocket-driver (4 CVEs): DoS vulnerabilities
- faraday (2 CVEs): Stack exhaustion DoS
- loofah: SVG href bypass
- net-imap (3 CVEs): Command injection
- crass (4 CVEs): CSS parsing DoS
- json: Heap buffer overflow
- rails-html-sanitizer: XSS vulnerability

## Post-Patch

### 1. Rotate All Secrets

After patching, immediately rotate:
- `secret_key_base`
- Database credentials
- API keys (SendGrid, AWS, etc.)
- Session tokens
- Any other credentials in environment variables

### 2. Check for Compromise

Review logs for suspicious activity around image uploads.

Also, set up monitoring for unusual file access or system behavior.

## Verification

After applying fixes, verify:

```bash
# Check Rails version
bundle exec rails -v  # Should be 8.1.3.1

# Check Puma version  
bundle exec puma -V  # Should be 8.0.2

# Check libvips security
bundle exec ruby -e 'require "vips"; puts Vips.at_least_libvips?(8, 13); puts Vips.respond_to?(:block_untrusted)'

# Run security audit
bundle exec bundler-audit check
```

---

## References

- [Rails Security Advisory](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)
- [CVE-2026-66066 Details](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432)
- [KindaRails2Shell Research](https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066)

Please share this with all OTW Archive fork operators.