stimulus_reflex 3.5.0.pre3

1 security vulnerability found in version 3.5.0.pre3

StimulusReflex arbitrary method call

high severity CVE-2024-28121
high severity CVE-2024-28121
Patched versions: ~> 3.4.2, >= 3.5.0.rc4

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{
  "target": "[class_name]#[method_name]",
  "args": []
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

{
  "target": "StimulusReflex::Reflex#render_collection",
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library. 1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.