CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex
Attackers can invoke unintended methods on Reflex instances via websockets, potentially leading to code execution or privilege escalation in Rails applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28121?
CVE-2024-28121 is a high-severity code injection vulnerability in stimulusreflex stimulus_reflex, published on 12 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.
Weakness: CWE-470
Which versions are affected by CVE-2024-28121?
8 open source packages ship an affected version, including stimulus_reflex. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stimulus_reflex RubyGems | All versions | 3.4.2 |
stimulus_reflex RubyGems | All versions | 3.4.2 |
stimulus_reflex RubyGems | From 3.5.0.pre0 | 3.5.0.rc4 |
stimulus_reflex RubyGems | From 3.5.0.pre0 | 3.5.0.rc4 |
stimulus_reflex npm | All versions | 3.4.2 |
stimulus_reflex npm | All versions | 3.4.2 |
2 more packages
stimulus_reflex npm | From 3.5.0-pre0 | 3.5.0-rc4 |
stimulus_reflex npm | From 3.5.0-pre0 | 3.5.0-rc4 |
Products include Stimulusreflex Stimulusrelfex.
How do I fix CVE-2024-28121?
Upgrade stimulus_reflex to a fixed version for your release line: 3.4.2, 3.5.0.rc4 or 3.5.0-rc4.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-28121 being exploited?
There is no known exploitation of CVE-2024-28121 in the wild and no public exploit code.
Sources
Also known as GHSA-f78j-4w3g-4q65.