1 line
5.8 KiB
JSON
1 line
5.8 KiB
JSON
{"schema_version":"1.9.2","id":"GHSA-3w93-6hmw-whh4","published":"2026-11-12T23:37:55Z","modified":"2026-11-12T23:45:03.302501225Z","aliases":["CVE-2026-126084"],"summary":"Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control","details":"### Impact\nWhen a GCS service is configured with the `cache_control` option, `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host` headers. A direct-upload client can therefore send a `Content-Type` of its choosing, and can omit the declared `Content-MD5`, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the `response-content-type` that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on `storage.googleapis.com`. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket.\n\nApplications that use the GCS service with `cache_control` configured and accept direct uploads are affected. GCS services without `cache_control` sign with V2 and are not affected.\n\n### Details\nThe fixed releases sign every GCS direct-upload URL with V2, which binds an empty `Content-Type` and the declared `Content-MD5`. The configured `Cache-Control` is still returned by `headers_for_direct_upload` and sent by the client, but it is no longer part of the signature, and direct-upload URLs for these services are no longer limited to V4's seven-day maximum expiry. See the Active Storage CHANGELOG.\n\n### Workarounds\nRemoving the `cache_control` option from the GCS service configuration makes Active Storage sign direct uploads with V2.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1.patch\n- 8.0: https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126084"},{"type":"WEB","url":"https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1"},{"type":"WEB","url":"https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-3w93-6hmw-whh4.yml"}],"database_specific":{"cwe_ids":["CWE-345"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:37:55Z","nvd_published_at":"2026-11-10T21:19:27Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} |