CVE-2024-28121: 
JavaScript vulnerability analysis and mitigation

StimulusReflex, a system that extends Rails and Stimulus capabilities through websocket interactions, was found to contain a vulnerability (CVE-2024-28121) that allows more methods than intended to be called on reflex instances. The vulnerability affects versions up to 3.4.1 and 3.5.0.rc3, with patches available in versions 3.4.2 and 3.5.0.rc4 (GitHub Advisory).

The vulnerability stems from the way StimulusReflex handles method calls through websocket messages. When a reflex is invoked, a websocket message with the format {"target":"[class_name]#[method_name]","args":[]} is sent. The server instantiates a reflex using the provided class_name and attempts to call method_name with the provided arguments. The issue arises because reflex.method(method_name) can access more methods than those explicitly defined by developers in their reflex class, including potentially dangerous methods like instance_variable_set (GitHub Advisory, Full Disclosure).

The vulnerability could allow attackers to execute arbitrary code, manipulate trusted variables, and gain unauthorized access to debugging features. For example, attackers could overwrite trusted variables used in after_reflex callbacks, bind debugging servers, or drop processes into REPL sessions (GitHub Advisory).

The vulnerability can be exploited by sending specially crafted websocket messages to call unintended methods. For instance, an attacker could use the instance_variable_set method to overwrite trusted variables or exploit the render_collection method for arbitrary code execution. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

For users unable to upgrade immediately, a workaround is available by adding a guard in the ApplicationReflex class. This involves ensuring all reflexes inherit from ApplicationReflex and adding a before_reflex callback that validates method calls. The recommended solution is to upgrade to patched versions 3.4.2 or 3.5.0.rc4 (GitHub Advisory).