Urgent: Critical Ruby on Rails Vulnerability Exploited by Attackers

Post Views: 17

Hackers are exploiting a critical-severity vulnerability in Ruby on Rails, enabling remote code execution (RCE) and exposing sensitive data, according to security firm VulnCheck.

Vulnerability Overview

The flaw, designated CVE-2026-66066 with a CVSS score of 9.5, is named KindaRails2Shell. It allows attackers to perform arbitrary file reads, expose sensitive data, execute RCE, and move laterally within affected systems. The vulnerability was patched in late July, but threat actors began exploiting it within a month of the fix.

How the Exploit Works

The vulnerability arises from discrepancies in how libraries handle file interpretation. Ruby on Rails uses client-supplied content types to identify files as images, while libvips uses magic bytes. Attackers craft files labeled as MATLAB Level 5, prompting libvips to use the MATLAB loader. This triggers libmatio to process the file, identifying it as MAT 7.3 and passing it to HDF5. The HDF5 External File List feature allows datasets to reference external files, enabling the “image” to read arbitrary server files and return their contents as pixel data.

Patch and Aftermath

Ruby on Rails released patches in late July, urging immediate updates for applications using libvips for Active Storage image processing and permitting image uploads from untrusted sources. Researchers reverse-engineered the vulnerability, publishing technical details and PoC code. Rails also provided forensic tools to detect exploitation attempts. However, a variation-key Marshal deserialization vulnerability remained active on patched systems, allowing RCE with a valid signature.

According to VulnCheck, threat actors began exploiting CVE-2026-66066 approximately one month after the patches were released. Testing on a patched Rails 8.1.3.1 server revealed that while the libvips file read was blocked, a variation-key Marshal deserialization vulnerability remained active.

Impact and Recommendations

VulnCheck identified around 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell. The flaw highlights the risks of complex dependency chains and challenges in mitigating vulnerabilities across software layers. Security teams are advised to apply patches promptly, monitor for exploitation signs, and review configurations involving libvips and Active Storage.

Conclusion

The incident underscores the importance of continuous vulnerability management and proactive threat detection in modern application stacks. Organizations must prioritize timely updates and rigorous security audits to mitigate risks from such exploits.