Government Rails Site Hit Hours After CVE Patch (rietta.com)

Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better.

We recently updated the design. This is a very old site so it has some quirks in the design for sure.

Not running, but supported. You can check your app with:

    bin/rails runner '
      require "vips"
      puts "ruby-vips #{Vips::VERSION}  libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
      begin
        Vips::Operation.new("matload")
        puts "matload PRESENT - this build can reach libmatio"
      rescue Vips::Error
        puts "matload ABSENT - this build cannot reach libmatio"
      end
    '

I think the answer is no - this would affect any Rails app with default settings that uses ActiveStorage. The "Preconditions" recap at the bottom here has all the appropriate caveats: https://ethiack.com/info-hub/research/kindarails2shell-how-a...

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

Since the vulnerability is exploited by a crafted binary file, I think that isn't something that CF's managed ruleset is able to protect against. They have the ability to scan incoming files with antivirus, but if the exploit is small and simple and can be mutated per request, I think it's unlikely any AV would pick it up.

Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.

Where does it say the site used Cloudflare?

He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!

What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854

The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.