Vulnerability-Lookup

CVE-2024-28121 (GCVE-0-2024-28121)

Vulnerability from cvelistv5 – Published: 2024-03-12 19:44 – Updated: 2025-02-13 17:47

Title

Reflex arbitrary method call in stimulus_reflex

Summary

stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-13 14:29 UTC

CWE

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/stimulusreflex/stimulus_reflex…	x_refsource_CONFIRM
https://github.com/stimulusreflex/stimulus_reflex…	x_refsource_MISC
https://github.com/stimulusreflex/stimulus_reflex…	x_refsource_MISC
https://github.com/stimulusreflex/stimulus_reflex…	x_refsource_MISC
https://github.com/stimulusreflex/stimulus_reflex…	x_refsource_MISC
http://seclists.org/fulldisclosure/2024/Mar/16

Impacted products

2 products

Vendor	Product	Version	CPE status
stimulusreflex	stimulus_reflex	Affected: >= 3.5.0.rc1, < 3.5.0.rc4 Affected: < 3.4.2	guessed
stimulusreflex	stimulus_reflex	Affected: 0 , < 3.4.2 (custom) Affected: 3.5.0.rc1 , < 3.5.0.rc4 (custom) cpe:2.3:a:stimulusreflex:stimulus_reflex::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.423Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:stimulusreflex:stimulus_reflex:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "stimulus_reflex",
            "vendor": "stimulusreflex",
            "versions": [
              {
                "lessThan": "3.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.5.0.rc4",
                "status": "affected",
                "version": "3.5.0.rc1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-13T14:29:13.739952Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T19:34:43.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "stimulus_reflex",
          "vendor": "stimulusreflex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.5.0.rc1, \u003c 3.5.0.rc4"
            },
            {
              "status": "affected",
              "version": "\u003c 3.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-13T21:05:59.246Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
        },
        {
          "name": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
        },
        {
          "name": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
        },
        {
          "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
        },
        {
          "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
        }
      ],
      "source": {
        "advisory": "GHSA-f78j-4w3g-4q65",
        "discovery": "UNKNOWN"
      },
      "title": "Reflex arbitrary method call in stimulus_reflex"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28121",
    "datePublished": "2024-03-12T19:44:29.591Z",
    "dateReserved": "2024-03-04T14:19:14.060Z",
    "dateUpdated": "2025-02-13T17:47:15.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-28121",
      "date": "2026-09-29",
      "epss": "0.01555",
      "percentile": "0.74177"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
        },
        {
          "lang": "es",
          "value": "stimulus_reflex es un sistema para ampliar las capacidades de Rails y Stimulus interceptando las interacciones del usuario y pas\u00e1ndolas a Rails a trav\u00e9s de websockets en tiempo real. En las versiones afectadas se pueden invocar m\u00e1s m\u00e9todos de los esperados en instancias reflejas. Poder llamar a algunos de ellos tiene implicaciones de seguridad. Para invocar un reflejo, se env\u00eda un mensaje websocket con la siguiente forma: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. El servidor proceder\u00e1 a crear una instancia de `reflex` utilizando el `class_name` proporcionado siempre que extienda `StimulusReflex::Reflex`. Luego intenta llamar a \"method_name\" en la instancia con los argumentos proporcionados. Esto es problem\u00e1tico ya que `reflex.method method_name` puede contener m\u00e1s m\u00e9todos que los especificados expl\u00edcitamente por el desarrollador en su clase refleja. Un buen ejemplo es el m\u00e9todo instance_variable_set. Esta vulnerabilidad ha sido parcheada en las versiones 3.4.2 y 3.5.0.rc4. Los usuarios que no puedan actualizar deben: consultar el aviso de respaldo de GHSA para obtener consejos de mitigaci\u00f3n."
        }
      ],
      "id": "CVE-2024-28121",
      "lastModified": "2024-11-21T09:05:51.707",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-03-12T20:15:08.313",
      "references": [
        {
          "source": "security-advisories@github.com",
          "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-470"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "stimulus_reflex",
                "vendor": "stimulusreflex",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.5.0.rc1, \u003c 3.5.0.rc4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 3.4.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:stimulusreflex:stimulus_reflex:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "stimulus_reflex",
                "vendor": "stimulusreflex",
                "versions": [
                  {
                    "lessThan": "3.4.2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "3.5.0.rc4",
                    "status": "affected",
                    "version": "3.5.0.rc1",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2AF2E16-66DC-4D13-9874-5A085F749360",
                    "versionEndExcluding": "3.4.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:*",
                    "matchCriteriaId": "43E5D805-62D2-4F50-A685-84085E31B857",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:*",
                    "matchCriteriaId": "2C430B21-0D71-4B80-BBE1-CF1BBAF8190D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:*",
                    "matchCriteriaId": "21D141A2-60A1-4F5C-955C-D40E70B3F12C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:*",
                    "matchCriteriaId": "453438E7-1F0B-43A9-8D94-A7510B0094FF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:*",
                    "matchCriteriaId": "57412721-4013-4EB3-AA4B-FB76773A5534",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:*",
                    "matchCriteriaId": "6BB95FE6-38EE-436B-93C7-A20967D9D03E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:*",
                    "matchCriteriaId": "D2CC3F1D-547A-4A03-A7D1-71132744B0CA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:*",
                    "matchCriteriaId": "70DA9FDB-843D-4D14-89F3-88DB9AF46CA7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:*",
                    "matchCriteriaId": "67299098-B253-4678-9C40-F6980EDF0879",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:*",
                    "matchCriteriaId": "FDB23841-1F34-44D2-B9DC-ED9736515754",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "D57C60F7-EBEC-4DDA-9649-2D4ABA117F09",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "604C86CB-59CF-4B84-A1D3-D0E982207FE6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "A096C05D-53EA-4713-A0B4-6AF522CC36A2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
          },
          {
            "lang": "es",
            "value": "stimulus_reflex es un sistema para ampliar las capacidades de Rails y Stimulus interceptando las interacciones del usuario y pas\u00e1ndolas a Rails a trav\u00e9s de websockets en tiempo real. En las versiones afectadas se pueden invocar m\u00e1s m\u00e9todos de los esperados en instancias reflejas. Poder llamar a algunos de ellos tiene implicaciones de seguridad. Para invocar un reflejo, se env\u00eda un mensaje websocket con la siguiente forma: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. El servidor proceder\u00e1 a crear una instancia de `reflex` utilizando el `class_name` proporcionado siempre que extienda `StimulusReflex::Reflex`. Luego intenta llamar a \"method_name\" en la instancia con los argumentos proporcionados. Esto es problem\u00e1tico ya que `reflex.method method_name` puede contener m\u00e1s m\u00e9todos que los especificados expl\u00edcitamente por el desarrollador en su clase refleja. Un buen ejemplo es el m\u00e9todo instance_variable_set. Esta vulnerabilidad ha sido parcheada en las versiones 3.4.2 y 3.5.0.rc4. Los usuarios que no puedan actualizar deben: consultar el aviso de respaldo de GHSA para obtener consejos de mitigaci\u00f3n."
          }
        ],
        "id": "CVE-2024-28121",
        "lastModified": "2026-06-17T07:21:00.577",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-28121",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-13T14:29:13.739952Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-12T20:15:08.313",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Technical Description"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Technical Description"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-470"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:19:59+00:00",
      "cve": "CVE-2024-28121",
      "id": "CVE-2024-28121",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Reflex arbitrary method call in stimulus_reflex",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-28121.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:48:49.423Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
              },
              {
                "name": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
              },
              {
                "name": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
              },
              {
                "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
              },
              {
                "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:stimulusreflex:stimulus_reflex:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "stimulus_reflex",
                "vendor": "stimulusreflex",
                "versions": [
                  {
                    "lessThan": "3.4.2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "3.5.0.rc4",
                    "status": "affected",
                    "version": "3.5.0.rc1",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-28121",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-13T14:29:13.739952Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-15T19:34:39.330Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "stimulus_reflex",
              "vendor": "stimulusreflex",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.5.0.rc1, \u003c 3.5.0.rc4"
                },
                {
                  "status": "affected",
                  "version": "\u003c 3.4.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-470",
                  "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-03-12T19:44:29.591Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
            },
            {
              "name": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
            },
            {
              "name": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
            },
            {
              "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
            },
            {
              "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
            },
            {
              "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
            }
          ],
          "source": {
            "advisory": "GHSA-f78j-4w3g-4q65",
            "discovery": "UNKNOWN"
          },
          "title": "Reflex arbitrary method call in stimulus_reflex "
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-28121",
        "datePublished": "2024-03-12T19:44:29.591Z",
        "dateReserved": "2024-03-04T14:19:14.060Z",
        "dateUpdated": "2024-08-15T19:34:43.636Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-28121

Vulnerability from fkie_nvd - Published: 2024-03-12 20:15 - Updated: 2026-06-17 07:21

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	http://seclists.org/fulldisclosure/2024/Mar/16	Exploit, Third Party Advisory
security-advisories@github.com	https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83	Technical Description
security-advisories@github.com	https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f	Patch
security-advisories@github.com	https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2	Product, Release Notes
security-advisories@github.com	https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4	Product, Release Notes
security-advisories@github.com	https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2024/Mar/16	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83	Technical Description
af854a3a-2127-422b-91ae-364da2661108	https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2	Product, Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4	Product, Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65	Exploit, Vendor Advisory

Impacted products

Vendor	Product	Version
stimulusreflex	stimulusrelfex	*
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0
stimulusreflex	stimulusrelfex	3.5.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "stimulus_reflex",
          "vendor": "stimulusreflex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.5.0.rc1, \u003c 3.5.0.rc4"
            },
            {
              "status": "affected",
              "version": "\u003c 3.4.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:stimulusreflex:stimulus_reflex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "stimulus_reflex",
          "vendor": "stimulusreflex",
          "versions": [
            {
              "lessThan": "3.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.0.rc4",
              "status": "affected",
              "version": "3.5.0.rc1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2AF2E16-66DC-4D13-9874-5A085F749360",
              "versionEndExcluding": "3.4.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:*",
              "matchCriteriaId": "43E5D805-62D2-4F50-A685-84085E31B857",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:*",
              "matchCriteriaId": "2C430B21-0D71-4B80-BBE1-CF1BBAF8190D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:*",
              "matchCriteriaId": "21D141A2-60A1-4F5C-955C-D40E70B3F12C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:*",
              "matchCriteriaId": "453438E7-1F0B-43A9-8D94-A7510B0094FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:*",
              "matchCriteriaId": "57412721-4013-4EB3-AA4B-FB76773A5534",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:*",
              "matchCriteriaId": "6BB95FE6-38EE-436B-93C7-A20967D9D03E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:*",
              "matchCriteriaId": "D2CC3F1D-547A-4A03-A7D1-71132744B0CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:*",
              "matchCriteriaId": "70DA9FDB-843D-4D14-89F3-88DB9AF46CA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:*",
              "matchCriteriaId": "67299098-B253-4678-9C40-F6980EDF0879",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:*",
              "matchCriteriaId": "FDB23841-1F34-44D2-B9DC-ED9736515754",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "D57C60F7-EBEC-4DDA-9649-2D4ABA117F09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "604C86CB-59CF-4B84-A1D3-D0E982207FE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "A096C05D-53EA-4713-A0B4-6AF522CC36A2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
    },
    {
      "lang": "es",
      "value": "stimulus_reflex es un sistema para ampliar las capacidades de Rails y Stimulus interceptando las interacciones del usuario y pas\u00e1ndolas a Rails a trav\u00e9s de websockets en tiempo real. En las versiones afectadas se pueden invocar m\u00e1s m\u00e9todos de los esperados en instancias reflejas. Poder llamar a algunos de ellos tiene implicaciones de seguridad. Para invocar un reflejo, se env\u00eda un mensaje websocket con la siguiente forma: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. El servidor proceder\u00e1 a crear una instancia de `reflex` utilizando el `class_name` proporcionado siempre que extienda `StimulusReflex::Reflex`. Luego intenta llamar a \"method_name\" en la instancia con los argumentos proporcionados. Esto es problem\u00e1tico ya que `reflex.method method_name` puede contener m\u00e1s m\u00e9todos que los especificados expl\u00edcitamente por el desarrollador en su clase refleja. Un buen ejemplo es el m\u00e9todo instance_variable_set. Esta vulnerabilidad ha sido parcheada en las versiones 3.4.2 y 3.5.0.rc4. Los usuarios que no puedan actualizar deben: consultar el aviso de respaldo de GHSA para obtener consejos de mitigaci\u00f3n."
    }
  ],
  "id": "CVE-2024-28121",
  "lastModified": "2026-06-17T07:21:00.577",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28121",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-03-13T14:29:13.739952Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-03-12T20:15:08.313",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Technical Description"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F78J-4W3G-4Q65

Vulnerability from github – Published: 2024-03-12 15:44 – Updated: 2024-09-25 20:56

Summary

StimulusReflex arbitrary method call

Details

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

Read more Let's imagine a reflex that uses `@user` as a trusted variable in an `after_reflex` callback. This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the [ChatReflex sample reflex](https://github.com/hopsoft/stimulus_reflex_expo/blob/dcce8c36a6782d1e7f57f0e2766a3f6fd770b3b1/app/reflexes/chat_reflex.rb) - `remote_byebug`: bind a debugging server - `pry`: drop the process in a REPL session All in all, only counting `:req` and `:opt` parameters helps. For example around [version 1.0](https://github.com/stimulusreflex/stimulus_reflex/blob/1f610b636abfed27de2c61104aebd1ac98180d5b/lib/stimulus_reflex/channel.rb#L41) only `.arity` was checked which allowed access to the `system` method (`.arity == -1`)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using `public_send` instead of `send` does not help but the following payloads **do not** work since `:rest` parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are: - 3.4.2 - 3.5.0.rc4

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "stimulus_reflex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0.pre0"
            },
            {
              "fixed": "3.5.0.rc4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "stimulus_reflex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "stimulus_reflex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0-pre0"
            },
            {
              "fixed": "3.5.0-rc4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "stimulus_reflex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-12T15:44:49Z",
    "nvd_published_at": "2024-03-12T20:15:08Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nMore methods than expected can be called on reflex instances. Being able to call some of them has security implications.\n\n### Details\nTo invoke a reflex a websocket message of the following shape is sent:\n```json\n{ \n  \"target\": \"[class_name]#[method_name]\", \n  \"args\": [] \n}\n```\nThe server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`.\nIt then attempts to call `method_name` on the instance with the provided arguments [ref](https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83):\n\n```ruby\nmethod = reflex.method method_name\nrequired_params = method.parameters.select { |(kind, _)| kind == :req }\noptional_params = method.parameters.select { |(kind, _)| kind == :opt }\n\nif arguments.size \u003e= required_params.size \u0026\u0026 arguments.size \u003c= required_params.size + optional_params.size\n  reflex.public_send(method_name, *arguments)\nend\n```\n\nThis is problematic as `reflex.method(method_name)` can be more methods than those explicitly specified by the developer in their reflex class. A good example is the `instance_variable_set` method.\n\n\u003cdetails\u003e\n\n\u003csummary\u003eRead more\u003c/summary\u003e\nLet\u0027s imagine a reflex that uses `@user` as a trusted variable in an `after_reflex` callback.\n\nThis variable can be overwritten using the following message:\n```json\n{\n  \"target\": \"ChatReflex#instance_variable_set\", \n  \"args\": [\"@user\", \"\u003cadmin-id\u003e\"]\n}\n```\n\nHere are other interesting methods that were found to be available for the [ChatReflex sample reflex](https://github.com/hopsoft/stimulus_reflex_expo/blob/dcce8c36a6782d1e7f57f0e2766a3f6fd770b3b1/app/reflexes/chat_reflex.rb)\n- `remote_byebug`: bind a debugging server\n- `pry`: drop the process in a REPL session\n\nAll in all, only counting  `:req` and `:opt` parameters helps.\nFor example around [version 1.0](https://github.com/stimulusreflex/stimulus_reflex/blob/1f610b636abfed27de2c61104aebd1ac98180d5b/lib/stimulus_reflex/channel.rb#L41) only `.arity` was checked which allowed access to the `system` method (`.arity == -1`)\n```json\n{\n  \"target\": \"ChatReflex#system\", \n  \"args\": [\"[command here]\"]\n}\n```\nUsing `public_send` instead of `send` does not help but the following payloads **do not** work since `:rest` parameters are not counted in the current version\n```json\n{\n  \"target\": \"ChatReflex#send\", \n  \"args\": [\"system\", \"[command here]\"] \n}\n```\n```json\n{ \n  \"target\": \"ChatReflex#instance_eval\", \n  \"args\": [\"system(\u0027[command here]\u0027)\"]\n}\n```\n\n\u003c/details\u003e\n\nPre-versions of 3.5.0 added a `render_collection` method on reflexes with  a `:req` parameter. Calling this method could lead to arbitrary code execution:\n```json\n{\n  \"target\": \"StimulusReflex::Reflex#render_collection\", \n  \"args\": [\n    { \"inline\":  \"\u003c% system(\u0027[command here]\u0027) %\u003e\" }\n  ]\n}\n```\n\n### Patches\n\nPatches are [available on RubyGems](https://rubygems.org/gems/stimulus_reflex) and on [NPM](https://npmjs.org/package/stimulus_reflex). \n\nThe patched versions are: \n- [`3.4.2`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2)\n- [`3.5.0.rc4`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4)\n\n### Workaround\n\nYou can add this guard to mitigate the issue if running an unpatched version of the library. \n\n1.) Make sure all your reflexes inherit from the `ApplicationReflex` class\n2.) Add this `before_reflex` callback to your `app/reflexes/application_reflex.rb` file:\n\n```ruby\nclass ApplicationReflex \u003c StimulusReflex::Reflex\n  before_reflex do\n    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]\n    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }\n\n    raise ArgumentError.new(\"Reflex method \u0027#{method_name}\u0027 is not defined on class \u0027#{self.class.name}\u0027 or on any of its ancestors\") if !allowed\n  end\nend\n```",
  "id": "GHSA-f78j-4w3g-4q65",
  "modified": "2024-09-25T20:56:24Z",
  "published": "2024-03-12T15:44:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stimulus_reflex/CVE-2024-28121.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stimulusreflex/stimulus_reflex"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "StimulusReflex arbitrary method call"
}

GSD-2024-28121

Vulnerability from gsd - Updated: 2024-03-05 06:02

Details

Aliases

CVE-2024-28121

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-28121"
      ],
      "details": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.",
      "id": "GSD-2024-28121",
      "modified": "2024-03-05T06:02:29.205023Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-28121",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "stimulus_reflex",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 3.5.0.rc1, \u003c 3.5.0.rc4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 3.4.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "stimulusreflex"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-470",
                "lang": "eng",
                "value": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65",
            "refsource": "MISC",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f",
            "refsource": "MISC",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83",
            "refsource": "MISC",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2",
            "refsource": "MISC",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
          },
          {
            "name": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4",
            "refsource": "MISC",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
          },
          {
            "name": "http://seclists.org/fulldisclosure/2024/Mar/16",
            "refsource": "MISC",
            "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-f78j-4w3g-4q65",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice."
          },
          {
            "lang": "es",
            "value": "stimulus_reflex es un sistema para ampliar las capacidades de Rails y Stimulus interceptando las interacciones del usuario y pas\u00e1ndolas a Rails a trav\u00e9s de websockets en tiempo real. En las versiones afectadas se pueden invocar m\u00e1s m\u00e9todos de los esperados en instancias reflejas. Poder llamar a algunos de ellos tiene implicaciones de seguridad. Para invocar un reflejo, se env\u00eda un mensaje websocket con la siguiente forma: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. El servidor proceder\u00e1 a crear una instancia de `reflex` utilizando el `class_name` proporcionado siempre que extienda `StimulusReflex::Reflex`. Luego intenta llamar a \"method_name\" en la instancia con los argumentos proporcionados. Esto es problem\u00e1tico ya que `reflex.method method_name` puede contener m\u00e1s m\u00e9todos que los especificados expl\u00edcitamente por el desarrollador en su clase refleja. Un buen ejemplo es el m\u00e9todo instance_variable_set. Esta vulnerabilidad ha sido parcheada en las versiones 3.4.2 y 3.5.0.rc4. Los usuarios que no puedan actualizar deben: consultar el aviso de respaldo de GHSA para obtener consejos de mitigaci\u00f3n."
          }
        ],
        "id": "CVE-2024-28121",
        "lastModified": "2024-03-13T21:16:00.460",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-03-12T20:15:08.313",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "http://seclists.org/fulldisclosure/2024/Mar/16"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-470"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-28121 (GCVE-0-2024-28121)

FKIE_CVE-2024-28121

GHSA-F78J-4W3G-4Q65

Summary

Details

Patches

Workaround

GSD-2024-28121

Tags

Sightings

Nomenclature

Related by attack behaviour