GHSA-6vgc-f9v5-8939: 
Ruby vulnerability analysis and mitigation

Impact

MetaInspector downloads images to determine missing dimensions using FastImage, which makes its own HTTP requests outside the Faraday session used for the document. These requests do not use faraday_options, including the redirect callback, an explicitly configured proxy, or TLS options. An attacker who controls a page processed by an application can include <img> elements pointing directly to internal services, loopback addresses or cloud metadata endpoints, or to a public endpoint that redirects to an internal address. When the application calls images.with_size, images.largest, or images.best without a preferred metadata image, MetaInspector may issue GET requests to those addresses even if the application configured a Faraday redirect callback to reject internal destinations. Image downloading is enabled by default (download_images: true). The affected path processes images with missing width or height attributes. Merely constructing a document or calling to_hash does not trigger these image downloads. This is blind server-side request forgery: response bodies are interpreted as images and are not returned to the attacker. The available results are image dimensions, image selection, and timing. It can allow internal network probing and GET requests with side effects against internal services. It does not directly expose cloud metadata credentials; IMDSv2 requires methods and headers that this request path does not supply. Applications that process attacker-controlled pages and perform image size lookups are affected. Network-level egress restrictions still apply. The redirect callback has been available since 5.15.0; automatic image downloading has existed since 4.2.0.

Patches

Upgrade to 5.20.0. Image size lookups now use Faraday with the page's proxy, TLS and redirect configuration, and FastImage parses a bounded binary IO rather than making its own HTTP requests. Version 5.20.0 adds an optional url_filter: callable to validate the initial page URL, optional HEAD request, image URLs and every redirect destination before requesting them. Returning false or nil raises MetaInspector::RequestError; exceptions raised by the filter propagate. Applications must configure their destination policy. Private IP addresses are not blocked by default. The existing redirect callback continues to run only on redirects. Move destination validation to url_filter: to protect initial URLs as well as redirects. For example, an application that fetches only two trusted HTTPS origins can use:

allowed_hosts = %w[example.com images.example.com]
filter = proc { |uri| uri.scheme == 'https' && uri.port == 443 && allowed_hosts.include?(uri.hostname) }
page = MetaInspector.new(url, url_filter: filter)

The README also includes an IP-address filtering example and explains the DNS rebinding limitation of resolving separately from the connection. Use network egress restrictions when processing untrusted URLs. Image requests keep custom page headers on the page's origin and strip credentials and arbitrary custom headers from cross-origin requests. Each size lookup has a 256 KiB response body budget and a two-second overall timeout, including redirects.

Workarounds

Disable image downloading when processing untrusted pages:

page = MetaInspector.new(url, download_images: false)

In 5.19.0, max_image_downloads: 0 also disables image size downloads. Dimensions already declared in HTML remain available. A Faraday redirect callback alone does not mitigate this image request path. Applications should also restrict outbound network access to internal and metadata services.

References

• Affected code: https://github.com/jaimeiniesta/metainspector/blob/87081a8db08aa3fe35c19d43e8daffbf23394da7/lib/meta_inspector/parsers/images.rb#L51
• Redirect callback support introduced in https://github.com/jaimeiniesta/metainspector/pull/355
• Related, separately fixed issue: https://github.com/jaimeiniesta/metainspector/security/advisories/GHSA-mm2p-6q2v-7ph5
• Fix: https://github.com/jaimeiniesta/metainspector/commit/886007ef205182a593f41822a91f635de25e687a
• URL filtering examples: https://github.com/jaimeiniesta/metainspector#filtering-request-urls