Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Remediation
References
Related Vulnerabilities
WordPress Plugin Easy PayPal Buy Now Button Cross-Site Scripting (1.7.3)
MODX Improper Restriction of XML External Entity Reference Vulnerability (CVE-2020-25911)
WebLogic CVE-2021-35617 Vulnerability (CVE-2021-35617)
PleskLin URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-24044)
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0185)