CVE-2022-24720
📋 TL;DR
CVE-2022-24720 is a critical command injection vulnerability in the image_processing Ruby gem that allows attackers to execute arbitrary shell commands when processing user-supplied image operations. This affects any application using image_processing gem versions before 1.12.2, particularly Ruby on Rails applications with Active Storage that process user-uploaded images.
💻 Affected Systems
- image_processing Ruby gem
- Ruby on Rails Active Storage
📦 What is this software?
Image Processing by Image Processing Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete server takeover.
Likely Case
Unauthorized shell command execution allowing file system access, data exfiltration, or lateral movement within the environment.
If Mitigated
Limited impact with proper input validation and sanitization preventing command injection.
🎯 Exploit Status
Exploitation requires user input to reach the vulnerable #apply method, which is common in image upload scenarios.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.2
Vendor Advisory: https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
Restart Required: Yes
Instructions:
1. Update Gemfile to require 'image_processing', '>= 1.12.2'
2. Run 'bundle update image_processing'
3. Restart your Ruby application server
🔧 Temporary Workarounds
Input Sanitization Workaround
allSanitize user input by allowing only a constrained set of image processing operations before passing to image_processing.
🧯 If You Can't Patch
- Implement strict input validation to only allow predefined safe image processing operations
- Disable image processing for user-uploaded content or use alternative image processing libraries
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show image_processing' to see installed versionCheck Version:
bundle show image_processing | grep -o 'image_processing.*'Verify Fix Applied:
Verify image_processing version is 1.12.2 or higher using 'bundle show image_processing'📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands in application logs
- Suspicious image processing parameters containing shell metacharacters
Network Indicators:
- Outbound connections from application server to unexpected destinations
SIEM Query:
source="application.log" AND ("image_processing" OR "Active Storage") AND ("apply" OR "shell")🔗 References
- https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
- https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
- https://www.debian.org/security/2022/dsa-5310
- https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
- https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
- https://www.debian.org/security/2022/dsa-5310
