KindaRails2Shell / CVE-2026-66066

CVE-2026-66066, commonly called KindaRails2Shell, allows a remote unauthenticated attacker to use crafted Active Storage uploads and libvips variant processing to read files accessible to the Rails application process. Rails assigns CVSS v4 9.5; fixed Active Storage versions are 7.2.3.2, 8.0.5.1, and 8.1.3.1, with libvips 8.13 or later required.

The most valuable detection is not an endpoint IOC search. The known read primitive executes inside the Rails/libvips process and leaves durable Active Storage database/object-store artifacts. Falcon CQL in this pack therefore focuses on post-exploitation behavior: Ruby or web workers spawning shells/utilities, unusual outbound connections, and unexpected listeners. Native database, object-store, and request-log hunts remain the authoritative exploitation test.

Confidence: High. Core facts agree across vendor and national CERT sources. No campaign-specific domains, IPs, hashes, or filenames were published; none are invented here.

Detection hypotheses

1. H1 · High: a compromised Rails worker may spawn a shell or command utility not expected in normal image processing.
2. H2 · Medium: a compromised Ruby/Rails process may invoke download, scripting, or networking tools for second-stage execution.
3. H3 · Medium: a Ruby/Rails worker may connect to uncommon remote ports after secret theft or RCE.
4. H4 · Medium: a Ruby/Rails or shell process may create an unexpected listening socket.
5. H5 · Medium: a Ruby-spawned shell may reference Rails secrets, environment files, SSH keys, or cloud credentials.

Attack chain

The Rails and JPCERT sources describe the vulnerability and impact; ATT&CK technique assignments are explicitly analyst mappings, not source attribution.

1. Preserve first: export Rails/proxy request logs, Active Storage tables, object-store version/lifecycle metadata, and relevant cloud/database audit logs before cleanup jobs run.
2. Exposure window: inventory Active Storage/Rails, libvips, and ruby-vips versions and identify when :vips, direct uploads, and variant tracking were enabled.
3. Candidate objects: prioritize unattached blobs with variant records, then read only their first 128 bytes and test the contradictory MAT header fields documented by Rails.
4. Successful-read proof: preserve the source blob, variant-record row, attached variant image, timestamps, checksums, and object metadata. Recover the target path and returned bytes from the artifacts.
5. Request-log correlation: join candidate checksums/byte sizes to direct-upload requests; correlate subsequent representation GETs and any signed-ID attach/destroy/update paths.
6. Secret-use audit: search cloud, database, Rails session, object-store, and third-party logs for use of process-readable credentials during and after the exposure window.

Limit: a clean scan is strong evidence, not proof. Unattached-blob cleanup, object lifecycle rules, missing variant tracking, attach-then-purge behavior, and short log retention bound conclusions.

Set the Falcon time picker to the full exposure window where retention permits. These queries identify endpoint-visible follow-on activity; they do not detect the in-process file-read primitive.

// HUNT: KindaRails2Shell - Rails Worker Spawns Unix Shell
// MITRE: T1059.004
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 on Linux Rails hosts
// FALSE POSITIVES: deployment hooks, maintenance jobs, health checks, legitimate shell-backed worker tasks
// TUNING: exclude approved parent paths, service accounts, and exact command lines only after baselining
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(ruby|puma|passenger|unicorn|sidekiq)$/i
| FileName=/^(sh|bash|dash|zsh|ksh)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, TargetProcessId_decimal])

// HUNT: KindaRails2Shell - Rails Worker Launches Download or Scripting Tool
// MITRE: T1105, T1059
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 on Linux Rails hosts
// FALSE POSITIVES: approved remote-content fetchers, package tasks, monitoring scripts, media-processing wrappers
// TUNING: exclude documented application jobs by full parent path and known command-line pattern
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(ruby|puma|passenger|unicorn|sidekiq)$/i
| FileName=/^(curl|wget|nc|ncat|socat|python|python3|perl|php|node)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

// HUNT: KindaRails2Shell - Rails Worker Connects to Uncommon Remote Port
// MITRE: T1571, T1105
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NetworkConnectIP4 on Linux Rails hosts
// FALSE POSITIVES: SSH automation, database/cache backends, internal APIs, application-specific service ports
// TUNING: replace the port list with ports outside the approved Rails egress baseline and allowlist known destinations
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(ruby|puma|passenger|unicorn|sidekiq)$/i
| RemotePort=/^(22|23|2222|4444|5555|6666|7777|8080|8888|9001)$/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4, LocalPort, Protocol_decimal])

// HUNT: KindaRails2Shell - Unexpected Listener from Rails or Shell Process
// MITRE: T1571
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NetworkListenIP4 on Linux Rails hosts
// FALSE POSITIVES: Puma/Passenger listeners, metrics exporters, development consoles, container health endpoints
// TUNING: allowlist approved local ports and exact service paths for each production Rails role
#event_simpleName=NetworkListenIP4
| ContextBaseFileName=/^(ruby|puma|passenger|unicorn|sidekiq|sh|bash|dash|zsh|nc|ncat|socat)$/i
| LocalPort!=80
| LocalPort!=443
| LocalPort!=3000
| LocalPort!=9292
| table([@timestamp, aid, ComputerName, ContextBaseFileName, LocalAddressIP4, LocalPort, Protocol_decimal])

// HUNT: KindaRails2Shell - Rails-Spawned Process References Secret Material
// MITRE: T1552.001, T1059.004
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 on Linux Rails hosts
// FALSE POSITIVES: deployment, backup, configuration-management, credential-rotation, and break-glass procedures
// TUNING: exclude signed and scheduled maintenance jobs by service account, parent path, and exact command line
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(ruby|puma|passenger|unicorn|sidekiq)$/i
| FileName=/^(sh|bash|dash|zsh|cat|head|tail|sed|awk|grep|env|printenv|python|python3|perl)$/i
| CommandLine=/(RAILS_MASTER_KEY|secret_key_base|credentials\.yml\.enc|master\.key|DATABASE_URL|authorized_keys|id_rsa|AWS_SECRET_ACCESS_KEY)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])

IOA-1 · Web Application Worker Spawns Unix Shell

Scheduled search and alert package

Name: HUNT: Web Application Worker - Unix Shell Child

Description: Detects Ruby/Rails application workers that create Unix shells, a high-value post-exploitation behavior following a server-side application compromise. MITRE: T1059.004. Priority: HIGH when unexpected on a production web role. FP sources: deployment hooks, health checks, shell-backed worker tasks.

Subject: 🚨 HUNT ALERT 🚨 — Web Application Worker Spawned a Unix Shell (Possible RCE)

Body: A Ruby or Rails-associated worker created a Unix shell. Confirm the parent path and command line, then compare the event with deployment and scheduled-job records. If the shell is not an approved application behavior, preserve the process tree and network evidence, isolate the host, and begin the KindaRails2Shell native forensic workflow; this event is post-exploitation evidence, not proof of the initial file-read primitive.

Investigation checklist

1. Confirm #event_simpleName, ComputerName, UserName, and the event timestamp.
2. Validate ParentBaseFileName and full parent/child paths against the deployed Rails runtime.
3. Inspect CommandLine for remote commands, secret references, downloaders, or encoded content.
4. Pivot on aid and TargetProcessId_decimal to child processes and contemporaneous network events.
5. Compare with deployment, backup, health-check, and batch-job schedules; document the exact benign owner if known.
6. Search Q2–Q5 across the same host and environment; check proxy/Rails logs for direct-upload and representation activity.
7. Isolate and escalate if the shell is unexplained, contacts an unknown destination, reads secrets, or launches follow-on tooling.

No atomic indicators were published. The CSV below intentionally contains labelled replacement values and must not be imported until confirmed indicators are obtained from incident evidence or an authoritative update.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_CONFIRMED_SHA256,no_action,medium,2026-09-08,KindaRails2Shell incident-derived artifact,campaign:KindaRails2Shell
domain,REPLACE_WITH_CONFIRMED_DOMAIN,no_action,medium,2026-09-08,KindaRails2Shell incident-derived destination,campaign:KindaRails2Shell

Direct upload: POST /rails/active_storage/direct_uploads
Representation: GET /rails/active_storage/representations/redirect/
Header bytes 0-9: MATLAB 5.0
Header bytes 124-125: MAT 7.3 dispatch tag 0x0200
Strong success evidence: crafted unattached blob + variant record + rendered variant

Fixed Active Storage: 7.2.3.2 / 8.0.5.1 / 8.1.3.1
Required libvips: >= 8.13
Workaround on libvips >= 8.13: VIPS_BLOCK_UNTRUSTED=1
Alternative on ruby-vips >= 2.2.1: Vips.block_untrusted(true)
Confirm untrusted uploads, :vips processor, direct-upload exposure, and track_variants history.

[ ] Active Storage blob / attachment / variant-record rows
[ ] First 128 bytes and checksums of candidate objects
[ ] Rendered variant image and object metadata/version history
[ ] Rails, reverse-proxy, WAF and load-balancer request logs
[ ] Object-store access, lifecycle and deletion logs
[ ] Cloud, database, IdP and third-party secret-use audit logs
[ ] Secret rotation timeline and session invalidation evidence

Pack build validation on 2026-08-08: structure/date/escaping, field lint, syntax lint, IOC provenance, and duplicate re-check are required to pass before dry-run release.

Playbook A · Patch and verify the runtime

Prerequisites: application checkout, Ruby/Bundler toolchain, staging environment, database/object-store backups, and an application-specific smoke test. Reboot required: No; application/container restart required. Rollback: redeploy the prior immutable image or restore the previous lockfile only for emergency service recovery, then disable :vips/untrusted uploads until a fixed build is restored. Rolling back reintroduces the vulnerability.

# Inspect exact resolved versions
bundle exec ruby -e 'require "active_storage"; puts ActiveStorage.gem_version'
vips --version
bundle exec ruby -e 'require "vips"; puts Vips::version_string'

# Update within the application's supported Rails branch, then run its tests
bundle update rails activestorage ruby-vips
bundle exec ruby -e 'require "active_storage"; puts ActiveStorage.gem_version'
vips --version
bundle exec rake test

Verify: resolved Active Storage is fixed, libvips is 8.13 or later, the application boots, direct upload/variant tests pass, and vulnerable images are no longer deployed.

Playbook B · Enforce libvips untrusted-operation blocking

Prerequisites: libvips 8.13 or later, systemd-managed Rails service, and a staging smoke test. Reboot required: No; service restart required. Rollback: remove the drop-in and restart only after fixed Active Storage is confirmed; keep the control if rollback would restore vulnerable code.

# Replace the service name with the production Rails unit.
sudo systemctl edit REPLACE_WITH_RAILS_SERVICE.service

# Add this drop-in content:
[Service]
Environment="VIPS_BLOCK_UNTRUSTED=1"

# Apply and verify
sudo systemctl daemon-reload
sudo systemctl restart REPLACE_WITH_RAILS_SERVICE.service
sudo systemctl show REPLACE_WITH_RAILS_SERVICE.service -p Environment

Rollback: sudo systemctl revert REPLACE_WITH_RAILS_SERVICE.service, then daemon-reload and restart. The labelled service placeholder is intentional; no environment-specific unit name was assumed.

Playbook C · Isolate the Rails worker with systemd

Prerequisites: systemd service, documented application write paths, canary node, and restore access. Reboot required: No; service restart required. Rollback: revert the drop-in and restart the unit.

sudo systemctl edit REPLACE_WITH_RAILS_SERVICE.service

# Pilot and tailor ReadWritePaths before production rollout.
[Service]
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
PrivateDevices=true
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=REPLACE_WITH_REQUIRED_UPLOAD_AND_CACHE_PATHS

sudo systemctl daemon-reload
sudo systemctl restart REPLACE_WITH_RAILS_SERVICE.service
systemctl show REPLACE_WITH_RAILS_SERVICE.service -p NoNewPrivileges -p ProtectSystem -p ProtectHome -p PrivateTmp

Rollback: sudo systemctl revert REPLACE_WITH_RAILS_SERVICE.service, daemon-reload, and restart. Pilot because strict filesystem protection can break upload, cache, socket, and log paths.

Coverage summary: endpoint coverage is good for Ruby-to-shell execution and partial for follow-on network/tool behavior. The exploit primitive, successful data read, and cleanup path require application/database/object-store telemetry. Validation gates: baseline all process/network hunts, run safe canary tests, and never interpret a clean Falcon result as proof of no exploitation.