Executive brief
StimulusReflex is a Ruby library that enables reactive components in web applications by allowing the server to call methods on reflex instances via WebSocket messages. An authenticated attacker can invoke unintended methods on these instances—including dangerous built-in Ruby methods like `instance_variable_set` and `system`—leading to data manipulation, code execution, or complete system compromise.
Technical details
The vulnerability is a method validation bypass in the reflex invocation handler (CWE-470: unsafe reflection). When processing WebSocket messages with a target like `ClassName#method_name`, the server uses `reflex.method(method_name)` to retrieve the method and then calls it via `public_send()`. However, `reflex.method()` returns any public method on the object, not just those explicitly defined in the reflex class. The server only validates that the method's required and optional parameters match the supplied arguments, but this does not restrict access to dangerous inherited methods (e.g., `instance_variable_set`, `system`, `instance_eval`, `pry`, `remote_byebug`). An authenticated attacker sending a crafted WebSocket message can call these methods with arbitrary arguments to modify instance variables, execute system commands, or drop into a REPL. The vulnerability affects all versions prior to 3.4.2 and 3.5.0.rc4; patches are available on RubyGems.
Affected products
- StimulusReflex StimulusReflex < 3.4.2 and < 3.5.0.rc4
Timeline
- 2024-03-12: disclosed
- 2024-03-12: patched: Version 3.4.2 and 3.5.0.rc4 released