7 ms·

Government Rails Site Hit Hours After CVE Patch

117 points by rietta 12d ago

dorianmariecom 12d ago
i thought cloudflare would protect against those no?
- ceejayoz 12d ago
  Where does it say the site used Cloudflare?
- rietta 12d ago
  Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.
- bastawhiz 12d ago
  Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.
  - rietta 12d ago
    I agree. And unstated in this write up is the direct upload route. Even if your Cloudflare was perfect, once the attacker got the preflight they send the binary file up to S3 directly and then hit the variant route directly. The first code to “validate” the upload was the exploitable libvips code.
comrade1234 12d ago
Do you have to have matlab running on your rails server for this to happen?
- rietta 12d ago
  I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.
  - kawsper 12d ago
    libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted: vips -l VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load
    - rietta 12d ago
      Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
- bradly 12d ago
  Not running, but supported. You can check your app with: bin/rails runner ' require "vips" puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}" begin Vips::Operation.new("matload") puts "matload PRESENT - this build can reach libmatio" rescue Vips::Error puts "matload ABSENT - this build cannot reach libmatio" end ' This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob/main/skills/kr2s-was-i-vulnerable/references/guide.md https://github.com/rails/rails-forensics-CVE-2026-66066/blob...
shevy-java 12d ago
DHH needs to focus on Rails again rather than Omarchy.
- stephenhuey 12d ago
  He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!
  - dleink 12d ago
    I don't know. Austin isn't the city I fell in love with in the 90s and early 2000s. Chiefly because it's no longer full of native Texans.
    - tclancy 12d ago
      Took me a minute, but absolutely lovely.
    - stephenhuey 12d ago
      I’m a native Texan, and I can deign to go to Austin for a couple days even though I live in a much bigger city in Texas which has delicious food from far more countries than Austin does. Plenty of Texans, and plenty of room for people from everywhere.
- tyre 12d ago
  What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854 https://news.ycombinator.com/item?id=49499854 The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
  - deleted 12d ago
    [deleted]
  - 12d ago
hobonation 12d ago
[dead]
tyre 12d ago
This post could be 10% as long: - There was a bug with a patch - We applied it to our clients - There were live exploits within eight hours of the patch being released - The Rails team had to expedite release of the technical details because POCs obviated the need to embargo
- adastra22 12d ago
  What is shocking to me is that it took eight hours.
jeremyjh 12d ago
Nice write up, Claude.
deleted 12d ago
[deleted]
throwatdem12311 12d ago
Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people. We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell. What a time to be alive.
- jcupitt 12d ago
  The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running: https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier. You can block or allow specific load operations, so you can limit format support to just the types you need: https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_method https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met... That might be even better. There was a post on libvips.org about this a while ago: https://www.libvips.org/2022/05/28/What's-new-in-8.13.html https://www.libvips.org/2022/05/28/What's-new-in-8.13.html And a note about it in the checklist for devs: https://www.libvips.org/API/current/developer-checklist.html#security https://www.libvips.org/API/current/developer-checklist.html...
  - rietta 8d ago
    I wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.
kazinator 12d ago
> That is about as bad as it gets and meant that any delay in patching was an existential risk of imminent compromise. Overdramatized. It means compromise if you delay patching and don't take the unpatched deployment offline. Oh right, this is government sites; every second of down time is lost revenue.
onemoresoop 12d ago
This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?
- rietta 6d ago
  HN has moved on, but I wanted to come back again and say thank you to you and those who replied below. I just pushed an update to the website that makes the header much more mobile device friendly.
- rietta 12d ago
  Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better. We recently updated the design. This is a very old site so it has some quirks in the design for sure.
  - bavell 12d ago
    Android Firefox here, top nav takes up 1/3rd of the viewport
    - throooooo 12d ago
      Same. So much spacing between the 3 lines. If they want to keep that huge header I'd suggest it gracefully entirely disappear when scrolling down and reappear when scrolling up.
      - rietta 6d ago
        I didn't go with the scroll up but did drastically shrink the header and make a hamburger menu. I still like having it sticky because many a time I have been on a page and forgot who I was reading. Hopefully what is up now is a good tradeoff and provides good experience for a future reader. Appreciate you.
BirAdam 12d ago
There are so many CVEs related to upload… and basic user/group/file permissions and proper rules within the web proxy could mitigate them. It reeks of people just writing stuff and tossing it up thinking that they’ve crafted something so great they needn’t worry. Get a good platform team.

117 points by rietta 12d ago

dorianmariecom 12d ago

i thought cloudflare would protect against those no?

ceejayoz 12d ago
Where does it say the site used Cloudflare?
rietta 12d ago
Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.
bastawhiz 12d ago
Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.
- rietta 12d ago
  I agree. And unstated in this write up is the direct upload route. Even if your Cloudflare was perfect, once the attacker got the preflight they send the binary file up to S3 directly and then hit the variant route directly. The first code to “validate” the upload was the exploitable libvips code.

comrade1234 12d ago

Do you have to have matlab running on your rails server for this to happen?

rietta 12d ago
I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.
- kawsper 12d ago
  libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted: vips -l VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load
  - rietta 12d ago
    Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
bradly 12d ago
Not running, but supported. You can check your app with: bin/rails runner ' require "vips" puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}" begin Vips::Operation.new("matload") puts "matload PRESENT - this build can reach libmatio" rescue Vips::Error puts "matload ABSENT - this build cannot reach libmatio" end ' This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob/main/skills/kr2s-was-i-vulnerable/references/guide.md https://github.com/rails/rails-forensics-CVE-2026-66066/blob...

shevy-java 12d ago

DHH needs to focus on Rails again rather than Omarchy.

stephenhuey 12d ago
He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!
- dleink 12d ago
  I don't know. Austin isn't the city I fell in love with in the 90s and early 2000s. Chiefly because it's no longer full of native Texans.
  - tclancy 12d ago
    Took me a minute, but absolutely lovely.
  - stephenhuey 12d ago
    I’m a native Texan, and I can deign to go to Austin for a couple days even though I live in a much bigger city in Texas which has delicious food from far more countries than Austin does. Plenty of Texans, and plenty of room for people from everywhere.
tyre 12d ago
What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854 https://news.ycombinator.com/item?id=49499854 The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
- deleted 12d ago
  [deleted]
- 12d ago

hobonation 12d ago

[dead]

tyre 12d ago

This post could be 10% as long: - There was a bug with a patch - We applied it to our clients - There were live exploits within eight hours of the patch being released - The Rails team had to expedite release of the technical details because POCs obviated the need to embargo

adastra22 12d ago
What is shocking to me is that it took eight hours.

jeremyjh 12d ago

Nice write up, Claude.

deleted 12d ago

[deleted]

throwatdem12311 12d ago

Just sent this to my boss. Felt like tossing a grenade over a fence into a party of unsuspecting people. We don’t use ActiveStorage but Claude was able create a similar exploit in own our app in the exact same way via our own file upload library in 3 minutes simply by point Opus 5 at our site and asking it if we were vulnerable to an attack similar to KindaRails2Shell. What a time to be alive.

jcupitt 12d ago
The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running: https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier. You can block or allow specific load operations, so you can limit format support to just the types you need: https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_method https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met... That might be even better. There was a post on libvips.org about this a while ago: https://www.libvips.org/2022/05/28/What's-new-in-8.13.html https://www.libvips.org/2022/05/28/What's-new-in-8.13.html And a note about it in the checklist for devs: https://www.libvips.org/API/current/developer-checklist.html#security https://www.libvips.org/API/current/developer-checklist.html...
- rietta 8d ago
  I wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.

kazinator 12d ago

> That is about as bad as it gets and meant that any delay in patching was an existential risk of imminent compromise. Overdramatized. It means compromise if you delay patching and don't take the unpatched deployment offline. Oh right, this is government sites; every second of down time is lost revenue.

onemoresoop 12d ago

This website is format is really weird for mobile, I can only read two lines of text. The rest is covered by a big banner. Im on IOS. Anybody else having this issue or is it just me?

rietta 6d ago
HN has moved on, but I wanted to come back again and say thank you to you and those who replied below. I just pushed an update to the website that makes the header much more mobile device friendly.
rietta 12d ago
Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better. We recently updated the design. This is a very old site so it has some quirks in the design for sure.
- bavell 12d ago
  Android Firefox here, top nav takes up 1/3rd of the viewport
  - throooooo 12d ago
    Same. So much spacing between the 3 lines. If they want to keep that huge header I'd suggest it gracefully entirely disappear when scrolling down and reappear when scrolling up.
    - rietta 6d ago
      I didn't go with the scroll up but did drastically shrink the header and make a hamburger menu. I still like having it sticky because many a time I have been on a page and forgot who I was reading. Hopefully what is up now is a good tradeoff and provides good experience for a future reader. Appreciate you.

BirAdam 12d ago

There are so many CVEs related to upload… and basic user/group/file permissions and proper rules within the web proxy could mitigate them. It reeks of people just writing stuff and tossing it up thinking that they’ve crafted something so great they needn’t worry. Get a good platform team.