{"vulnerability": "cve-2025-24293", "sightings": [{"uuid": "b3a8dd73-621f-4906-b264-45a53e568d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24293", "type": "seen", "source": "https://gist.github.com/omid-storyful/ad62fd00008868617d9703d12aa29478", "content": "", "creation_timestamp": "2025-10-29T13:31:08.000000Z"}, {"uuid": "d5c80557-9104-4d31-8714-46c7a53618cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24293", "type": "seen", "source": "https://gist.github.com/omid-storyful/932f7b8d388ffa7dd9d6eb3103b1830b", "content": "", "creation_timestamp": "2025-10-29T13:47:42.000000Z"}, {"uuid": "94f2b04d-9022-49db-8049-67503765d41b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24293", "type": "seen", "source": "https://t.me/thehackernews/9675", "content": "\ud83d\udea8 New from Ethiack: A crafted MATLAB/HDF5 upload can make Rails Active Storage read server secrets.\n\nAttackers could then use a stolen secret_key_base to forge a variation key and reach RCE via CVE-2025-24293.\n\nRails also released a forensic toolkit to check exposure and hunt for exploitation.\n\nRead the updated story: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-31T12:00:03.947353Z"}, {"uuid": "a54f9363-8b0b-401b-b38d-6833332cbd9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24293", "type": "seen", "source": "https://t.me/thehackernews/9675", "content": "\ud83d\udea8 New from Ethiack: A crafted MATLAB/HDF5 upload can make Rails Active Storage read server secrets.\n\nAttackers could then use a stolen secret_key_base to forge a variation key and reach RCE via CVE-2025-24293.\n\nRails also released a forensic toolkit to check exposure and hunt for exploitation.\n\nRead the updated story: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-08-01T00:00:32.012508Z"}, {"uuid": "7de97df1-f78e-47b0-9cf4-6f77fc5fdd17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24293", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_activestorage_vips_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, ruby\", \"author\": [\"0xacb\", \"s3np41k1r1t0\", \"castilho\", \"RyotaK\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when\\n          the application uses the Vips variant processor and accepts untrusted image\\n          uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text\\n          files accessible to the Rails worker through a PNG representation response.\\n\\n          The module recovers secret_key_base from the process environment, Rails local\\n          secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then\\n          forges a serializer-compatible variation whose ImageProcessing apply step reaches\\n          Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when\\n          the Ruby target is selected. Neither path requires a Marshal object gadget. The\\n          Ruby target's initial code execution does not require a Unix shell or a fetch\\n          utility on the target.\\n\\n          The file-read stage needs a genuine signed Active Storage variation key. It can use\\n          VARIATION_KEY directly, reuse a representation URL from the application, or create\\n          one through an application upload form. Supplying SECRET_KEY_BASE skips the\\n          arbitrary file-read stage and lets the module construct the standard\\n          representation route itself.\\n\\n          The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1,\\n          Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in\\n          Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete\\n          Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch;\\n          ImageProcessing 2.x blocks this chain.\", \"disclosure_date\": \"2026-07-29\", \"fullname\": \"exploit/multi/http/rails_activestorage_vips_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 11:44:52 +0000\", \"name\": \"Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/multi/http/rails_activestorage_vips_rce.rb\", \"platform\": \"Linux,Ruby,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/http/rails_activestorage_vips_rce\", \"references\": [\"CVE-2026-66066\", \"GHSA-xr9x-r78c-5hrm\", \"CVE-2025-24293\", \"GHSA-r4mg-4433-c7g3\", \"URL-https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails\", \"URL-https://blog.flatt.tech/entry/kindarails2shell_rails\", \"URL-https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/\", \"URL-https://github.com/rails/rails/pull/56995\", \"URL-https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441\", \"URL-https://github.com/rails/rails-forensics-CVE-2026-66066\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux/Unix Command\", \"Ruby\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:10.269291Z"}]}