Rails Active Storage Disk Upload With MATLAB Header Disguised As Image - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects the file bytes uploaded to a Rails Active Storage disk service endpoint carrying the MATLAB level 5 file header, consistent with CVE-2026-66066 KindaRails2Shell arbitrary file read exploitation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte les octets uploades vers l'endpoint disk service d'Active Storage Rails portant l'en-tete de fichier MATLAB niveau 5 ("MATLAB 5.0"), coherent avec l'exploitation de CVE-2026-66066 (KindaRails2Shell). CORRECTION IMPORTANTE (red team interne) : la premiere version de cette regle cherchait la signature MATLAB dans le meme corps de requete que la declaration content_type sur /rails/active_storage/direct_uploads. C'est techniquement incorrect : ce endpoint ne recoit que des metadonnees JSON (filename, byte_size, checksum, content_type), jamais les octets du fichier. Les octets reels sont envoyes dans une requete PUT separee vers le service de stockage local (/rails/active_storage/disk/) pour les deploiements sur disque, ou directement vers un stockage cloud (S3/GCS/Azure) invisible dans les logs Rails pour les deploiements cloud. Cette version cible donc la requete PUT vers le disk service, ou la signature MATLAB a reellement une chance d'etre visible. Voir README_ANGLES_MORTS.md pour la limite residuelle sur le stockage cloud. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Rails Active Storage Disk Upload With MATLAB Header Disguised As Image - STRICT
id: 6fd51abd-7d41-4115-b884-ca21205f3fa6
status: experimental
description: |
Detects the file bytes uploaded to a Rails Active Storage disk service endpoint carrying the MATLAB level 5 file header, consistent with CVE-2026-66066 KindaRails2Shell arbitrary file read exploitation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte les octets uploades vers l'endpoint disk service d'Active Storage Rails portant l'en-tete de fichier MATLAB niveau 5 ("MATLAB 5.0"), coherent avec l'exploitation de CVE-2026-66066 (KindaRails2Shell). CORRECTION IMPORTANTE (red team interne) : la premiere version de cette regle cherchait la signature MATLAB dans le meme corps de requete que la declaration content_type sur /rails/active_storage/direct_uploads. C'est techniquement incorrect : ce endpoint ne recoit que des metadonnees JSON (filename, byte_size, checksum, content_type), jamais les octets du fichier. Les octets reels sont envoyes dans une requete PUT separee vers le service de stockage local (/rails/active_storage/disk/) pour les deploiements sur disque, ou directement vers un stockage cloud (S3/GCS/Azure) invisible dans les logs Rails pour les deploiements cloud. Cette version cible donc la requete PUT vers le disk service, ou la signature MATLAB a reellement une chance d'etre visible. Voir README_ANGLES_MORTS.md pour la limite residuelle sur le stockage cloud. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
- https://nvd.nist.gov/vuln/detail/CVE-2026-66066
- https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/
- https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/
- https://gist.github.com/win3zz/ae02cb1c3be0b79f69b609f559e1f179
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-06
modified: 2026-08-06
related:
- id: 6fb4dfe1-5b20-4556-9c5e-2a6d157c8959
type: derived
logsource:
category: webserver
detection:
selection_disk_service_path:
cs-uri-stem|contains: '/rails/active_storage/disk/'
selection_disk_service_path_alt:
Uri|contains: '/rails/active_storage/disk/'
selection_disk_service_path_url:
Url|contains: '/rails/active_storage/disk/'
selection_disk_service_path_url_path:
url.path|contains: '/rails/active_storage/disk/'
selection_http_put_cs_method:
cs-method:
- 'PUT'
- 'put'
selection_http_put_http_method:
HttpMethod:
- 'PUT'
- 'put'
selection_http_put_method:
http.request.method:
- 'PUT'
- 'put'
selection_matlab_header_requestbody:
RequestBody|contains: 'MATLAB 5.0'
selection_matlab_header_http_body:
http.request.body.content|contains: 'MATLAB 5.0'
selection_matlab_header_postdata:
post_data|contains: 'MATLAB 5.0'
selection_matlab_header_rawrequest:
RawRequest|contains: 'MATLAB 5.0'
condition: >
(selection_disk_service_path or selection_disk_service_path_alt or selection_disk_service_path_url or selection_disk_service_path_url_path)
and 1 of selection_http_put_*
and (selection_matlab_header_requestbody or selection_matlab_header_http_body or selection_matlab_header_postdata or selection_matlab_header_rawrequest)
fields:
- c-ip
- x-forwarded-for
- cs-host
- cs-method
- HttpMethod
- http.request.method
- cs-uri-stem
- Uri
- Url
- url.path
- c-useragent
- sc-status
- RequestBody
- http.request.body.content
- post_data
- RawRequest
falsepositives:
- Authorized security regression testing against a patched Rails instance
- A legitimate application feature that intentionally allows uploading MATLAB .mat files mislabeled as images, expected to be extremely rare
level: critical
tags:
- attack.initial-access
- attack.t1190
- attack.t1005
- cve.2026-66066