High, CVSS 8.8RubyGemsAmendedPublished
StimulusReflex arbitrary method call
CVE-2024-28121 · GHSA-f78j-4w3g-4q65
- Affected
- RubyGems stimulus_reflex >= 3.5.0.pre0, < 3.5.0.rc4; < 3.4.2
- Fixed in
- 3.5.0.rc43.4.2· Vendor fix available
- Issue
- More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: The server will proceed to instantiate reflex using the provided classname as long as it extends StimulusReflex::Reflex. It then attempts to call methodname on the instance with the provided arguments ref: This is problematic as reflex.method(methodname) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instancevariableset method. <details <summaryRead more</summary Let's imagine a reflex that uses @user as a trusted variable in an afterreflex callback. This variable can be overwritten using the following message: Here are other interesting methods that were found to be available for the ChatReflex sample reflex - remotebyebug: bind a debugging server - pry: drop the process in a REPL session All in all, only…
Recommended action: Upgrade to 3.5.0.rc4 or 3.4.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.