| Package | Affected versions | Patched versions |
|---|---|---|
| activestorage | ≥ 5.0.0, < 5.2.4.3≥ 6.0.0, < 6.0.3.1 | 5.2.4.36.0.3.1 |
| rails | ≥ 6.0.0, < 6.0.3.1< 5.2.4.2 | 6.0.3.15.2.4.2 |
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.
Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free