Government Rails Site Hit Hours After CVE Patch

2 comments

• comrade123419 minutes ago
  Do you have to have matlab running on your rails server for this to happen?
  • bradly2 minutes ago
    Not running, but supported. You can check your app with:<p><pre><code> bin&#x2F;rails runner &#x27; require &quot;vips&quot; puts &quot;ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}&quot; begin Vips::Operation.new(&quot;matload&quot;) puts &quot;matload PRESENT - this build can reach libmatio&quot; rescue Vips::Error puts &quot;matload ABSENT - this build cannot reach libmatio&quot; end &#x27; </code></pre> This is from the Rails official docs for the CVE which they released as an agent skill. <a href="https:&#x2F;&#x2F;github.com&#x2F;rails&#x2F;rails-forensics-CVE-2026-66066&#x2F;blob&#x2F;main&#x2F;skills&#x2F;kr2s-was-i-vulnerable&#x2F;references&#x2F;guide.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rails&#x2F;rails-forensics-CVE-2026-66066&#x2F;blob...</a>
  • rietta14 minutes ago
    I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.
    • kawsper4 minutes ago
      libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted:<p><pre><code> vips -l VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load</code></pre>
      • rietta0 minutes ago
        Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and &quot;indicators of compromise&quot; but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
• dorianmariecom21 minutes ago
  i thought cloudflare would protect against those no?
  • rietta15 minutes ago
    Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF &amp; Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.
  • ceejayoz19 minutes ago
    Where does it say the site used Cloudflare?