CVE-2025-24293: Active Storage RCE Vulnerability

CVE-2025-24293 Overview

CVE-2025-24293 is a critical command injection vulnerability in Ruby on Rails Active Storage. Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. However, the default allowed list contains three methods that enable circumvention of these safe defaults, creating potential command injection vulnerabilities when arbitrary user-supplied input is accepted as valid transformation methods or parameters.

This vulnerability specifically impacts applications using Active Storage with the image_processing gem in combination with mini_magick as the image processor. The flaw allows attackers to inject malicious commands through unsanitized image transformation parameters, potentially leading to remote code execution on the server.

Critical Impact

Attackers can achieve command injection and potentially remote code execution on servers running vulnerable Rails applications that pass unsanitized user input to Active Storage image transformation methods.

Affected Products

• Ruby on Rails Active Storage (versions with vulnerable allowed transformation methods)
• Applications using image_processing gem with mini_magick processor
• Rails applications accepting user input for image transformation parameters

Discovery Timeline

• 2026-01-30 - CVE CVE-2025-24293 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-24293

Vulnerability Analysis

This vulnerability falls under CWE-77 (Command Injection), where an attacker can execute arbitrary commands on the host operating system through the vulnerable application. The root issue stems from insufficient validation of image transformation methods in Active Storage's default allowed list.

When a Rails application uses Active Storage for image processing and accepts user-supplied input for transformation methods or their parameters, attackers can exploit certain allowed methods to bypass security controls. The vulnerability is network-accessible and requires no authentication or user interaction to exploit, though exploitation may require certain conditions to be present in the target application.

Root Cause

The vulnerability originates from three specific methods in Active Storage's default allowed transformation list that permit circumvention of safe defaults. These methods, when combined with user-controlled input, enable command injection through the underlying ImageMagick processing pipeline. The mini_magick gem interfaces directly with ImageMagick's command-line tools, and insufficient sanitization of method names or parameters allows shell metacharacters to escape the intended image processing context.

Attack Vector

The attack vector is network-based, requiring an attacker to send crafted HTTP requests to a vulnerable Rails endpoint that processes image transformations. Vulnerable code patterns accept user input directly in transformation method calls, such as:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

In this pattern, both params[:t] (the transformation method) and params[:v] (the parameter value) come from untrusted user input. An attacker can craft malicious values that, when processed by mini_magick and subsequently ImageMagick, result in command execution on the server. This could include reading sensitive files, establishing reverse shells, or compromising the underlying system. For technical details on the specific exploitation methods, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-24293

Indicators of Compromise

• Unusual image processing requests containing shell metacharacters (;, |, $(), backticks)
• Web server logs showing unexpected command execution errors from ImageMagick processes
• Abnormal system process spawning from Rails worker processes
• Network connections initiated by image processing workers to external hosts

Detection Strategies

• Monitor web application logs for image variant requests with suspicious parameter patterns
• Implement WAF rules to detect command injection payloads in image transformation parameters
• Deploy runtime application security monitoring to detect unexpected system calls from web workers
• Review Rails application code for patterns matching blob.variant(params[*]) with user input

Monitoring Recommendations

• Enable verbose logging for Active Storage image processing operations
• Monitor system process trees for child processes spawned by Rails workers during image handling
• Set up alerts for ImageMagick policy violations or command execution errors
• Track outbound network connections from application servers to detect potential reverse shells

How to Mitigate CVE-2025-24293

Immediate Actions Required

• Audit all Rails applications for code patterns that pass user input to Active Storage transformation methods
• Implement strict allowlisting of transformation methods and validate all parameters before processing
• Deploy a restrictive ImageMagick security policy to limit potential damage from exploitation
• Consider disabling image transformations that accept any form of user input until patches are applied

Patch Information

All users running affected releases should upgrade to patched versions immediately. Check the GitHub Security Advisory for specific version information and patch details. Update the activestorage and image_processing gems to their latest secure versions.

Workarounds

• Never pass unsanitized user input directly to image transformation methods
• Implement a strict allowlist of permitted transformation methods and validate against it
• Use predefined transformation presets instead of dynamic user-supplied parameters
• Deploy a comprehensive ImageMagick security policy as documented in the ImageMagick security policy documentation

# Example ImageMagick policy configuration (/etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml)
# Restrict potentially dangerous delegates and coders
<policy domain="delegate" rights="none" pattern="*" />
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="TEXT" />
<policy domain="coder" rights="none" pattern="LABEL" />
<policy domain="path" rights="none" pattern="@*" />