hackspeak/cve-2026-66066CVE-2026-66066 (KindaRails2Shell) PoC - Rails Active Storage/libvips arbitrary file read to RCE; for authorized security testing
Ruby on Rails Active Storage + libvips arbitrary file read → conditional remote code execution (RCE) PoC tool.
Single-file, Python 3.11+ pure standard library with zero dependencies, includes MAT/HDF5 hybrid payloads, a pure-Python PNG pixel decoder, offset reads, key recovery, RCE and scanning modes.
Rails trusts the client-reported content_type (direct upload endpoint), while libvips sniffs file magic bytes—the same file is treated as two different formats across the two layers. An attacker crafts a hybrid file whose "first 10 bytes of text claim MATLAB 5.0, bytes 124-125 version word declare MAT 7.3 (HDF5)", leverages the HDF5 External File List mechanism to read arbitrary server files (default /proc/self/environ), recovers SECRET_KEY_BASE, then forges signed variations to conditionally achieve command execution.
< 7.2.3.2 / >= 8.0, < 8.0.5.1 / >= 8.1, < 8.1.3.1python3 kr2s.py <command> [options]
| Command | Description |
|---|---|
check | Upload a blob to confirm the target file is readable (intrusive) |
read <path> | Recover a fixed-size prefix of the specified file (binary output) |
secrets | Recover process environment variables and Rails credential files (redacted by default; --show-full displays full values) |
rce | Recover secret_key_base and conditionally execute commands (--skb skips the environment read) |
probe | Probe untrusted loaders available to the target's libvips |
scan | Multithreaded passive/active scanning (--active uploads a malicious blob for canary reading) |
General options: target URL / hostname / batch files, --entry, --proxy, custom paths, TLS options, timeouts, User-Agent, etc. See python3 kr2s.py --help for details.
cd lab
RAILS_VERSION=8.1.3 docker compose up --build
For security research, vulnerability validation, and defensive testing only. The read / check / scan --active / rce commands upload persistent blobs to the target and execute commands on it. Please run them in a disposable Docker lab and do not use them against unauthorized targets.