CVE-2024-28121

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28121
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28121.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28121
Aliases
Published
2024-03-12T19:44:29.591Z
Modified
2026-07-08T08:10:49.250839680Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Reflex arbitrary method call in stimulus_reflex
Details

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: \"target\":\"[class_name]#[method_name]\",\"args\":[]. The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments. This is problematic as reflex.method method_name can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instancevariable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28121.json",
    "cwe_ids": [
        "CWE-470"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/stimulusreflex/stimulus_reflex

Affected ranges

Type
GIT
Repo
https://github.com/stimulusreflex/stimulus_reflex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
01803ad6a3cf85b6ee01a3b316a3feb206f3863d
Introduced
4b26f314dfbf699e19f9311b1a7bd253bc4eb46c
Fixed
538582d240439aab76066c72335ea92096cd0c7f
Fixed
3de99e49b5bc4bc477d92a3c550eb7b7cf56a8b7
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.2"
        },
        {
            "introduced": "3.5.0-pre1"
        },
        {
            "last_affected": "3.5.0-pre1"
        },
        {
            "introduced": "3.5.0-pre10"
        },
        {
            "last_affected": "3.5.0-pre10"
        },
        {
            "introduced": "3.5.0-pre2"
        },
        {
            "last_affected": "3.5.0-pre2"
        },
        {
            "introduced": "3.5.0-pre3"
        },
        {
            "last_affected": "3.5.0-pre3"
        },
        {
            "introduced": "3.5.0-pre4"
        },
        {
            "last_affected": "3.5.0-pre4"
        },
        {
            "introduced": "3.5.0-pre5"
        },
        {
            "last_affected": "3.5.0-pre5"
        },
        {
            "introduced": "3.5.0-pre6"
        },
        {
            "last_affected": "3.5.0-pre6"
        },
        {
            "introduced": "3.5.0-pre7"
        },
        {
            "last_affected": "3.5.0-pre7"
        },
        {
            "introduced": "3.5.0-pre8"
        },
        {
            "last_affected": "3.5.0-pre8"
        },
        {
            "introduced": "3.5.0-pre9"
        },
        {
            "last_affected": "3.5.0-pre9"
        },
        {
            "introduced": "3.5.0-rc1"
        },
        {
            "last_affected": "3.5.0-rc1"
        },
        {
            "introduced": "3.5.0-rc2"
        },
        {
            "last_affected": "3.5.0-rc2"
        },
        {
            "introduced": "3.5.0-rc3"
        },
        {
            "last_affected": "3.5.0-rc3"
        }
    ]
}

Affected versions

3.*
3.5.0-pre1
3.5.0-pre10
3.5.0-pre2
3.5.0-pre3
3.5.0-pre4
3.5.0-pre5
3.5.0-pre6
3.5.0-pre7
3.5.0-pre8
3.5.0-pre9
3.5.0-rc1
3.5.0-rc2
3.5.0-rc3
v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.12
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v3.2.0-pre0
v3.2.0.pre0
v3.2.0.pre1
v3.2.1
v3.2.2
v3.2.2.pre0
v3.2.2.pre1
v3.2.3
v3.3.0
v3.3.0.pre0
v3.3.0.pre1
v3.3.0.pre2
v3.3.0.pre3
v3.3.0.pre4
v3.3.0.pre5
v3.3.0.pre6
v3.4.0
v3.4.0.pre0
v3.4.0.pre1
v3.4.0.pre2
v3.4.0.pre3
v3.4.0.pre4
v3.4.0.pre5
v3.4.0.pre6
v3.4.0.pre7
v3.4.0.pre8
v3.4.0.pre9
v3.4.1
v3.5.0.pre1
v3.5.0.pre10
v3.5.0.pre2
v3.5.0.pre3
v3.5.0.pre4
v3.5.0.pre5
v3.5.0.pre6
v3.5.0.pre7
v3.5.0.pre8
v3.5.0.pre9
v3.5.0.rc1
v3.5.0.rc2
v3.5.0.rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28121.json"