Описание
StimulusReflex arbitrary method call
Summary
More methods than expected can be called on reflex instances. Being able to call some of them has security implications.
Details
To invoke a reflex a websocket message of the following shape is sent:
The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex.
It then attempts to call method_name on the instance with the provided arguments ref:
This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.
Read more
Let's imagine a reflex that uses `@user` as a trusted variable in an `after_reflex` callback.This variable can be overwritten using the following message:
Here are other interesting methods that were found to be available for the ChatReflex sample reflex
remote_byebug: bind a debugging serverpry: drop the process in a REPL session
All in all, only counting :req and :opt parameters helps.
For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)
Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version
Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:
Patches
Patches are available on RubyGems and on NPM.
The patched versions are:
Workaround
You can add this guard to mitigate the issue if running an unpatched version of the library.
1.) Make sure all your reflexes inherit from the ApplicationReflex class
2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:
Ссылки
- https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65
- https://nvd.nist.gov/vuln/detail/CVE-2024-28121
- https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f
- https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stimulus_reflex/CVE-2024-28121.yml
- https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4
- http://seclists.org/fulldisclosure/2024/Mar/16
Пакеты
stimulus_reflex
>= 3.5.0.pre0, < 3.5.0.rc4
3.5.0.rc4
stimulus_reflex
< 3.4.2
3.4.2
stimulus_reflex
>= 3.5.0-pre0, < 3.5.0-rc4
3.5.0-rc4
stimulus_reflex
< 3.4.2
3.4.2
Связанные уязвимости
stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.