CybersecurityUpdated November 4

Disk storage may expose files the app can read

The same flaw may also allow file reading, but only when attachments are stored with the Disk service. The Rails advisory says an attacker may be able to read any file the application process can access. That can include secret_key_base and credentials for external systems. The advisory says those credentials could, in turn, allow escalation to remote code execution or lateral movement—possible further consequences, not an automatic result of an upload.

1 publisher1 report

Coverage started November 4