Revision of CVE-2026-66066.md

brennan revised this gist 2 weeks ago. Go to revision

1 file changed, 10 insertions, 10 deletions

CVE-2026-66066.md

			@@ -140,16 +140,16 @@ docker restart <web-container>
140	140
141	141		## Additional Security Vulns
142	142
143		-	- Puma (2 CVEs) - PROXY Protocol DoS vulnerabilities
144		-	- concurrent-ruby (3 CVEs) - Livelocks and lock corruption
145		-	- nokogiri (9 vulnerabilities) - Memory safety issues
146		-	- websocket-driver (4 CVEs) - DoS vulnerabilities
147		-	- faraday (2 CVEs) - Stack exhaustion DoS
148		-	- loofah - SVG href bypass
149		-	- net-imap (3 CVEs) - Command injection
150		-	- crass (4 CVEs) - CSS parsing DoS
151		-	- json - Heap buffer overflow
152		-	- rails-html-sanitizer - XSS vulnerability
	143	+	- Puma (2 CVEs): PROXY Protocol DoS vulnerabilities
	144	+	- concurrent-ruby (3 CVEs): Livelocks and lock corruption
	145	+	- nokogiri (9 vulnerabilities): Memory safety issues
	146	+	- websocket-driver (4 CVEs): DoS vulnerabilities
	147	+	- faraday (2 CVEs): Stack exhaustion DoS
	148	+	- loofah: SVG href bypass
	149	+	- net-imap (3 CVEs): Command injection
	150	+	- crass (4 CVEs): CSS parsing DoS
	151	+	- json: Heap buffer overflow
	152	+	- rails-html-sanitizer: XSS vulnerability
153	153
154	154		## Post-Patch
155	155

brennan revised this gist 2 weeks ago. Go to revision

1 file changed, 4 insertions, 6 deletions

CVE-2026-66066.md

			@@ -1,4 +1,4 @@
1		-	# Critical: CVE-2026-66066
	1	+	# CVE-2026-66066
2	2
3	3		This is a vulnerability affecting all OTW Archive forks. The original OTW Archive is currently vulnerable. Immediate action is required to protect user data and prevent potential system compromise.
4	4
			@@ -27,11 +27,11 @@ bundle exec ruby -e 'require "vips"; puts Vips.version_string'
27	27		bundle exec bundler-audit check --update
28	28		```
29	29
30		-	If any versions are below the required levels, your system is VULNERABLE and needs immediate patching.
	30	+	If any versions are below the required levels, your system is vulnerable, and needs immediate patching.
31	31
32	32		## What is CVE-2026-66066?
33	33
34		-	"KindaRails2Shell": A critical vulnerability that allows unauthenticated attackers to:
	34	+	["KindaRails2Shell"](https://www.herodevs.com/blog-posts/cve-2026-66066-rails-active-storage-arbitrary-file-read-and-rce) is a critical vulnerability that allows unauthenticated attackers to:
35	35
36	36		- Read any file on the server (secrets, credentials, API keys)
37	37		- Achieve Remote Code Execution (RCE)
			@@ -166,9 +166,7 @@ After patching, immediately rotate:
166	166
167	167		Review logs for suspicious activity around image uploads.
168	168
169		-	### 3. Monitor for Anomalies
170		-
171		-	Set up monitoring for unusual file access or system behavior.
	169	+	Also, set up monitoring for unusual file access or system behavior.
172	170
173	171		## Verification
174	172

brennan revised this gist 2 weeks ago. Go to revision

1 file changed, 199 insertions

CVE-2026-66066.md(file created)

		@@ -0,0 +1,199 @@
1	+	# Critical: CVE-2026-66066
2	+
3	+	This is a vulnerability affecting all OTW Archive forks. The original OTW Archive is currently vulnerable. Immediate action is required to protect user data and prevent potential system compromise.
4	+
5	+	Severity: CRITICAL (CVSS 9.5/10)
6	+	Vulnerability: Arbitrary File Read & Remote Code Execution
7	+	Affected: All OTW Archive forks using Rails 8.1.0 or earlier with Active Storage + libvips
8	+
9	+	## Vulnerability Check
10	+
11	+	Run these commands to check if your system is vulnerable:
12	+
13	+	```bash
14	+	# Check Rails version (should be 8.1.3.1 or higher)
15	+	bundle exec rails -v
16	+
17	+	# Check Puma version (should be 8.0.2 or higher)
18	+	bundle exec puma -V
19	+
20	+	# Check libvips version (should be 8.13 or higher)
21	+	vips --version
22	+
23	+	# Check ruby-vips version (should be 2.2.1 or higher)
24	+	bundle exec ruby -e 'require "vips"; puts Vips.version_string'
25	+
26	+	# Run security audit to see all vulnerabilities
27	+	bundle exec bundler-audit check --update
28	+	```
29	+
30	+	If any versions are below the required levels, your system is VULNERABLE and needs immediate patching.
31	+
32	+	## What is CVE-2026-66066?
33	+
34	+	"KindaRails2Shell": A critical vulnerability that allows unauthenticated attackers to:
35	+
36	+	- Read any file on the server (secrets, credentials, API keys)
37	+	- Achieve Remote Code Execution (RCE)
38	+	- Escalate to lateral movement to other systems
39	+	- Potentially compromise cloud infrastructure
40	+
41	+	Attack Vector: Upload a crafted image file → trigger variant processing → read arbitrary files
42	+
43	+	Impact: 500,000+ estimated sites affected
44	+
45	+	## Current Vulnerability Status
46	+
47	+	\| Component \| OTW Archive (Current) \| Required \| Status \|
48	+	\| --------- \| --------------------- \| -------- \| ------------ \|
49	+	\| Rails \| 8.1.0 \| 8.1.3.1 \| ❌ VULNERABLE \|
50	+	\| Puma \| 6.5.0 \| 8.0.2 \| ❌ VULNERABLE \|
51	+
52	+	## Required Upgrades
53	+
54	+	### 1. Update Gemfile
55	+
56	+	```ruby
57	+	# Critical security updates
58	+	gem "rails", "~> 8.1.3.1"
59	+	gem "puma", "~> 8.0.2"
60	+	gem "ruby-vips", ">= 2.2.1"
61	+
62	+	# Additional security fixes (recommended)
63	+	gem "concurrent-ruby", ">= 1.3.7"
64	+	gem "nokogiri", ">= 1.19.4"
65	+	gem "faraday", ">= 2.14.3"
66	+	gem "websocket-driver", ">= 0.8.2"
67	+	gem "loofah", ">= 2.25.2"
68	+	gem "net-imap", ">= 0.6.4.1"
69	+	gem "crass", ">= 1.0.7"
70	+	gem "json", ">= 2.19.9"
71	+	gem "rails-html-sanitizer", ">= 1.7.1"
72	+	```
73	+
74	+	### 2. Remove Duplicate Dependencies
75	+
76	+	If you have duplicate nokogiri entries, remove the older one:
77	+	```ruby
78	+	# Remove this line if you have the security version above
79	+	gem 'nokogiri', '>= 1.8.5'
80	+	```
81	+
82	+	### 3. Add Security Initializer
83	+
84	+	Create `config/initializers/vips_security.rb`:
85	+	```ruby
86	+	# Security initializer to block untrusted libvips operations
87	+	# This mitigates CVE-2026-66066
88	+	if defined?(Vips)
89	+	if Vips.at_least_libvips?(8, 13) && Vips.respond_to?(:block_untrusted)
90	+	Vips.block_untrusted(true)
91	+	Rails.logger.info "VIPS_BLOCK_UNTRUSTED: Enabled - Untrusted libvips operations blocked"
92	+	else
93	+	Rails.logger.warn "VIPS_BLOCK_UNTRUSTED: Cannot enable - libvips >= 8.13 or ruby-vips >= 2.2.1 required"
94	+	end
95	+	end
96	+	```
97	+
98	+	### 4. Fix PhraseApp Compatibility (if using PhraseApp)
99	+
100	+	Update `config/initializers/monkeypatches/fix_phraseapp.rb`:
101	+	```ruby
102	+	if defined?(PhraseApp::VERSION) && PhraseApp::VERSION == "1.6.0"
103	+	PhraseApp::InContextEditor::BackendService.prepend(FixPhraseapp)
104	+	else
105	+	puts "WARNING: The monkeypatch #{__FILE__} was written for version 1.6.0 of the phraseapp-in-context-editor-ruby gem, but you are running #{defined?(PhraseApp::VERSION) ? PhraseApp::VERSION : 'unknown version'}. Please update or remove the monkeypatch."
106	+	end
107	+	```
108	+
109	+	Comment out `config/initializers/phraseapp_in_context_editor.rb` (API changed in v3.x):
110	+	```ruby
111	+	# PhraseApp::InContextEditor.configure do \|config\|
112	+	# # ... configuration commented out ...
113	+	# end
114	+	```
115	+
116	+	### 5. Update Bundle
117	+
118	+	```bash
119	+	bundle update
120	+	```
121	+
122	+	### 6. Verify libvips Version
123	+
124	+	```bash
125	+	# Check system libvips version
126	+	vips --version # Should be >= 8.13
127	+
128	+	# Or check via Ruby
129	+	bundle exec ruby -e 'require "vips"; puts Vips.version_string'
130	+	```
131	+
132	+	### 7. Restart Application
133	+
134	+	```bash
135	+	# If using Docker
136	+	docker restart <web-container>
137	+
138	+	# Or restart your web server
139	+	```
140	+
141	+	## Additional Security Vulns
142	+
143	+	- Puma (2 CVEs) - PROXY Protocol DoS vulnerabilities
144	+	- concurrent-ruby (3 CVEs) - Livelocks and lock corruption
145	+	- nokogiri (9 vulnerabilities) - Memory safety issues
146	+	- websocket-driver (4 CVEs) - DoS vulnerabilities
147	+	- faraday (2 CVEs) - Stack exhaustion DoS
148	+	- loofah - SVG href bypass
149	+	- net-imap (3 CVEs) - Command injection
150	+	- crass (4 CVEs) - CSS parsing DoS
151	+	- json - Heap buffer overflow
152	+	- rails-html-sanitizer - XSS vulnerability
153	+
154	+	## Post-Patch
155	+
156	+	### 1. Rotate All Secrets
157	+
158	+	After patching, immediately rotate:
159	+	- `secret_key_base`
160	+	- Database credentials
161	+	- API keys (SendGrid, AWS, etc.)
162	+	- Session tokens
163	+	- Any other credentials in environment variables
164	+
165	+	### 2. Check for Compromise
166	+
167	+	Review logs for suspicious activity around image uploads.
168	+
169	+	### 3. Monitor for Anomalies
170	+
171	+	Set up monitoring for unusual file access or system behavior.
172	+
173	+	## Verification
174	+
175	+	After applying fixes, verify:
176	+
177	+	```bash
178	+	# Check Rails version
179	+	bundle exec rails -v # Should be 8.1.3.1
180	+
181	+	# Check Puma version
182	+	bundle exec puma -V # Should be 8.0.2
183	+
184	+	# Check libvips security
185	+	bundle exec ruby -e 'require "vips"; puts Vips.at_least_libvips?(8, 13); puts Vips.respond_to?(:block_untrusted)'
186	+
187	+	# Run security audit
188	+	bundle exec bundler-audit check
189	+	```
190	+
191	+	---
192	+
193	+	## References
194	+
195	+	- [Rails Security Advisory](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)
196	+	- [CVE-2026-66066 Details](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432)
197	+	- [KindaRails2Shell Research](https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066)
198	+
199	+	Please share this with all OTW Archive fork operators.

Newer Older