CVE-2022-21831 Possible code injection vulnerability in Rails / Active Storage

Critical 9.8 Published 26 May 2022 Updated 3 Aug 2024

Attackers can execute arbitrary code via image processing arguments in Active Storage, requiring an upgrade to secure Ruby on Rails applications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21831?

CVE-2022-21831 is a critical code injection vulnerability in Debian Debian Linux, published on 26 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

Weakness: CWE-94

Which versions are affected by CVE-2022-21831?

8 open source packages ship an affected version, including activestorage. It affects 2 products.

Package	Affected	Fixed in
`activestorage` RubyGems	From `5.2.0`	`5.2.6.3`
`activestorage` RubyGems	From `5.2.0`	`5.2.6.3`
`activestorage` RubyGems	From `6.0.0`	`6.0.4.7`
`activestorage` RubyGems	From `6.0.0`	`6.0.4.7`
`activestorage` RubyGems	From `6.1.0`	`6.1.4.7`
`activestorage` RubyGems	From `6.1.0`	`6.1.4.7`

2 more packages

`activestorage` RubyGems	From `7.0.0`	`7.0.2.3`
`activestorage` RubyGems	From `7.0.0`	`7.0.2.3`

Linux distribution packages (4)

`ruby3.2-rubygem-activestorage-7.0` openSUSE:Tumbleweed	All versions	`7.0.4.3-1.1`
`rubygem-activestorage-7.0` openSUSE:Tumbleweed	All versions	`7.0.2.3-1.1`
`rubygem-activestorage-7.0` openSUSE:Tumbleweed	All versions	`7.0.8.4-1.1`
`rubygem-activestorage-7.0` openSUSE:Tumbleweed	All versions	`7.0.8.6-1.3`

Products include Debian Debian Linux, Rubyonrails Active Storage.

How do I fix CVE-2022-21831?

Upgrade activestorage to a fixed version for your release line: 5.2.6.3, 6.0.4.7, 6.1.4.7 or 7.0.2.3.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-21831 being exploited?

There is no known exploitation of CVE-2022-21831 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-21831, GHSA-w749-p3v6-hccq, UBUNTU-CVE-2022-21831, openSUSE-SU-2024:11903-1, openSUSE-SU-2024:12880-1, openSUSE-SU-2024:14070-1 and 1 more.