Rapid7 Analysis KindaRails2Shell (CVE-2026-66066)

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066
• Blog Title: Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
• Suggested Section: Pentesting Web > File Upload, with a dedicated Ruby on Rails Active Storage / libvips parser-confusion page; cross-reference Network Services Pentesting > 80,443 > Ruby Tricks and image-processing security

🎯 Content Summary

Overview

KindaRails2Shell (CVE-2026-66066) is an arbitrary file-read vulnerability in Ruby on Rails Active Storage applications that process untrusted uploads with the Vips image processor. Affected Active Storage ranges are < 7.2.3.2, >= 8.0, < 8.0.5.1, and >= 8.1, < 8.1.3.1. Vips is the default variant processor for applications loading Rails 7.0-or-later defaults; Rails 6 is affected only when Vips is explicitly...

🔧 Technical Details

Bypass file-type controls through pre-upload metadata: When an upload workflow creates a database object before receiving or inspecting the file, test whether the client can persist a trusted MIME type. Active Storage direct uploads accept and store content_type without running Marcel's server-side unfurl identification. Since Blob#variable? later checks only whether that stored string belongs to variable_content_types, a non-image object marked image/png can enter an image-processing pipeline.

Replay independently signed parameters: Signed values may provide authenticity without guaranteeing their relationship. If an endpoint separately verifies an object identifier and an operation/configuration token, test whether a token generated for one object can be applied to another. Active Storage accepts a genuine signed variation_key from one representation and indep...

🤖 Agent Actions

Using repo-inspection tools to find the best existing HackTricks page for Rails Active Storage / parser-confusion upload abuse.
Best fit is the existing File Upload page: adding the Rails/libvips parser-confusion upload technique there, with inline links to related Ruby/image-processing pages, while keeping all new content in a single file.
I found the new references landed near the top of the file instead of inside the final ## References section, so I'm correcting the placement before verification.
Done.

Updated:

• src/pentesting-web/file-upload/README.md

Added:

• Rails Active Storage direct-upload MIME trust abuse
• replay of independently signed processing tokens
• libvips/libmatio parser-confusion via spoofed MAT/HDF5 headers
• HDF5 external dataset storage as arbitrary file-read oracle
• brief file-read → signed transformation → RCE escalation notes
• technical detection/hardening notes
• references to the Rapid7 post, Rails advisory/PR, and Metasploit module

I verified the final diff and kept all new content in a single file.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > File Upload, with a dedicated Ruby on Rails Active Storage / libvips parser-confusion page; cross-reference Network Services Pentesting > 80,443 > Ruby Tricks and image-processing security".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0