CVE-2018-16477

MEDIUM

Exposure of Sensitive Information to an Unauthorized Actor in activestorage

Published December 5, 2018Updated February 22, 2024Source: osv

Summary

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. Vulnerable apps are those using either GCS or the Disk service in production. Other storage services such as S3 or Azure aren't affected.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update activestorage to 5.2.1.1 or later

gem install activestorage -v 5.2.1.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
activestorage	rubygems	5.2.0, 5.2.1, 5.2.1.rc1	5.2.1.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-200
Information ExposureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2018-16477?: Exposure of Sensitive Information to an Unauthorized Actor in activestorage This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2018-16477?: CVE-2018-16477 affects activestorage. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-16477 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-7rr7-rcjw-56vj

Related CVEs

CVE-2025-24293
CRITICAL
Active Storage allowed transformation methods that were potentially unsafe
CVE-2022-21831
CRITICAL
Possible code injection vulnerability in Rails / Active Storage
CVE-2026-33195
HIGH
Rails Active Storage has possible Path Traversal in DiskService
CVE-2020-8162
HIGH
Circumvention of file size limits in ActiveStorage
CVE-2024-26144
MEDIUM
Rails has possible Sensitive Session Information Leak in Active Storage
CVE-2026-33173
MEDIUM
Rails Active Storage has possible content type bypass via metadata in direct uploads
CVE-2026-33174
MEDIUM
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
CVE-2026-33658
LOW
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies