Government Rails Site Hit Hours After CVE Patch

7 comments

• oefrha 3 minutes ago
  > In practice, that embargo was functionally meaningless from the moment the patch shipped, and not because anyone breached it. The fix itself, a public code diff, was never embargoed at all, only the explanation of how to exploit it. That explanation didn’t even hold for a month.

  Yeah, even if you embargo the patch there’s a high chance it won’t help either these days. See recently discussed Just the rumour of a bug is enough to find an exploit these days https://news.ycombinator.com/item?id=49480466
• jeremyjh 14 minutes ago
  Nice write up, Claude.
• comrade1234 4 hours ago
  Do you have to have matlab running on your rails server for this to happen?
  [-]
  • bradly 4 hours ago
    Not running, but supported. You can check your app with:

        bin/rails runner '
          require "vips"
          puts "ruby-vips #{Vips::VERSION}  libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
          begin
            Vips::Operation.new("matload")
            puts "matload PRESENT - this build can reach libmatio"
          rescue Vips::Error
            puts "matload ABSENT - this build cannot reach libmatio"
          end
        '
    

    This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob...
    [-]
    • comrade1234 9 minutes ago
      Why would you have matlab on an external server? People don't even have a compiler on the server in this situation. Crazy.
  • fishtoaster 4 hours ago
    I think the answer is no - this would affect any Rails app with default settings that uses ActiveStorage. The "Preconditions" recap at the bottom here has all the appropriate caveats: https://ethiack.com/info-hub/research/kindarails2shell-how-a...
  • rietta 4 hours ago
    I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.
    [-]
    • kawsper 4 hours ago
      libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted:

          vips -l
          VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load

      [-]
      • rietta 4 hours ago
        Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
• dorianmariecom 4 hours ago
  i thought cloudflare would protect against those no?
  [-]
  • rietta 4 hours ago
    Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.
  • ceejayoz 4 hours ago
    Where does it say the site used Cloudflare?
• hobonation 3 hours ago
  [dead]
• shevy-java 3 hours ago
  DHH needs to focus on Rails again rather than Omarchy.
  [-]
  • stephenhuey 1 hour ago
    He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!
  • tyre 3 hours ago
    What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854

    The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.

    [-]
    • dangond 1 hour ago
      > What does DHH have to do with this?

      DHH created Rails.
• tyre 3 hours ago
  This post could be 10% as long:

  - There was a bug with a patch

  - We applied it to our clients

  - There were live exploits within eight hours of the patch being released

  - The Rails team had to expedite release of the technical details because POCs obviated the need to embargo