Module: Msf::Exploit::Remote::HTTP::RailsActiveStorageVips::FileReader

Included in:

Msf::Exploit::Remote::HTTP::RailsActiveStorageVips

Defined in:

lib/msf/core/exploit/remote/http/rails_active_storage_vips/file_reader.rb

Overview

Implements the bounded HDF5/Vips arbitrary file-read transport.

Constant Summary

EXPLOIT_DATA_DIR =

['exploits', 'CVE-2026-66066'].freeze

EXTERNAL_PATH_PLACEHOLDER =

'/rails_vips_external_path_placeholder_012345678901234567890123456789'.b.freeze

EXTERNAL_OFFSET_MARKER =

0x4d53460000000000

READ_LAYOUTS =

[256, 100, 64, 32, 20, 16].map do |dimension|
  data_columns = (dimension - 1) / 2
  {
    artifact: "ascii_#{dimension}.mat",
    dimension: dimension,
    data_columns: data_columns,
    capacity: data_columns * dimension
  }.freeze
end.freeze