A newly disclosed vulnerability in Ruby on Rails’ Active Storage component has drawn serious attention from the security community after researchers demonstrated a complete attack chain from server secret exposure to remote code execution.
Tracked as CVE-2026-66066 (GHSA-xr9x-r78c-5hrm), the flaw affects Active Storage releases before 7.2.3.2, as well as vulnerable Rails 8.0 and 8.1 releases, specifically when applications use the Vips variant processor for image handling.
The vulnerability stems from an untrusted-loader issue in how Active Storage interacts with libvips during image variant processing. Attackers can craft a direct-upload blob that, when processed through an Active Storage representation response, allows them to recover readable file content from the server. This is far more than a simple information leak.
Once attackers extract sufficient data, they can derive the Active Storage verifier key from recovered Rails signing material.
This key allows them to forge a signed ImageProcessing variation that executes arbitrary commands on the underlying system, completing the chain from read access to full remote code execution.
Researcher jburgess-r7 submitted a Metasploit module, exploit/multi/http/rails_activestorage_vips_rce, that implements the full attack chain documented in a Rails forensic analysis repository.
The module supports secret recovery from multiple sources, including /proc/self/environ, /proc/1/environ, local Rails secret files, encrypted credentials, and legacy secrets.yml configurations.
It works across SHA-1, SHA-256, SHA-384, and SHA-512 key-generator combinations, and it handles JSON, Marshal, and MessagePack-compatible signed message formats.
According to jburgess, a particularly effective feature of the exploit is its resize-tolerant exfiltration technique, which uses multiple square HDF5 layouts combined with Vips sharpen inversion to reliably extract data regardless of how the target application resizes images.
The module also accommodates both modern redirect routes and legacy Rails 6 representation routes, broadening its reach across different application versions.
In controlled testing against Rails 8.0.5 and Rails 6.0.6.1 targets, the exploit successfully recovered SECRET_KEY_BASE from process environment variables, derived the correct verifier key, and opened command shell sessions running as the Rails process user.
Testing also confirmed the exploit fails safely against patched Rails 8.0.5.1 targets, returning HTTP 500 errors when SECRET_KEY_BASE isn’t already known to the operator. This behavior gives defenders a useful signal when assessing exposure.
Notably, the released module deliberately omits certain research-only techniques from the original discovery, including a /proc/self/mem verifier-key recovery path and an instance_eval-based RCE variation.
The developer explained that the representation-based PNG transport method used in the released module produces larger, more reliably verifiable reads suited for automated secret recovery, making it preferable for practical exploitation over narrower metadata-based channels.
Organizations running Rails applications with Active Storage and the Vips variant processor should immediately prioritize patching to Active Storage 7.2.3.2 or later.
Given the module’s demonstrated reliability across multiple Rails versions and its support for reverse shell payloads, including cmd/unix/reverse_bash and Meterpreter, defenders should treat CVE-2026-66066 as a critical, actively exploitable risk rather than a theoretical concern.
No Comment! Be the first one.