A critical vulnerability in Ruby on Rails has raised new concerns about cloud data breaches, particularly for companies that host customer platforms in Amazon Web Services (AWS).
Known as CVE-2026-66066 or KindaRails2Shell, this flaw affects Active Storage deployments that utilize the libvips image-processing library and accept uploads from untrusted users.
While there is no specific confirmation of a breach involving 350,000 users, the vulnerability could potentially expose cloud credentials and customer data if attackers compromise a vulnerable application.
The security issue arises from Rails Active Storage’s image variant processing, which failed to block certain libvips operations deemed unsafe for handling untrusted content.
This oversight could enable an unauthenticated attacker to submit a specially crafted upload, allowing them to read files accessible to the Rails application process.
PoC for Rails Active Storage RCE Vulnerability
Sensitive files at risk may include environment variables, configuration files, database passwords, API tokens, and AWS access credentials. For organizations using AWS, the implications could be severe.
Stolen cloud credentials may grant attackers access to S3 buckets, databases, backups, application logs, and other connected services, depending on the permissions assigned to the compromised identity.
If a company stores user records, identity details, contact information, or internal files in its AWS environment, an incident could result in significant data exposure affecting hundreds of thousands of users.
Researchers have also warned that the issue could extend beyond simple file disclosure. Rails applications often store the secret_key_base in environment variables. If an attacker gains access to this secret, they could forge Rails-signed data and potentially execute remote code on the server.
This access would occur using the permissions assigned to the Rails process, potentially leading to further data theft, changes in application behavior, or exploitation of cloud services associated with the environment.
The affected configuration necessitates both libvips-based Active Storage processing and the acceptance of untrusted image uploads. Rails versions before Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1 are vulnerable in the affected ranges.
Rails 6 applications could also be at risk if administrators have manually configured Active Storage to use the Vips processor. A proposed Metasploit module on GitHub shows how attackers could chain file access and forged image data to achieve command execution.
This module has reportedly been tested in controlled environments against Rails versions 6.0.6.1, 6.1.7.10, and 8.0.5. Such public exploit development highlights the urgency for organizations to identify exposed Rails services and apply necessary updates.
Security teams should take immediate action to patch vulnerable Rails deployments, review Active Storage upload endpoints, rotate Rails secrets and AWS credentials if exposure is suspected, and audit AWS CloudTrail, S3, and application logs for any unusual access. Companies should also enforce least-privilege IAM roles and avoid storing long-lived cloud secrets in process environment variables.
The post Public PoC Released for Critical Rails Active Storage RCE Vulnerability appeared first on Cyber Security News.
