Executive brief
TurboBoost Commands is a Ruby and JavaScript library that allows developers to execute custom commands. The library's method invocation protections are insufficiently robust, allowing attackers to invoke unintended methods on Command classes. This could lead to unauthorized code execution if an application's authorization checks are not strict.
Technical details
The vulnerability is an improper input validation issue (CWE-74) in method invocation authorization. The library attempts to restrict execution to public methods on Command classes, but the checks can be bypassed by a sophisticated attacker. The affected component is the command routing/dispatch mechanism that verifies which methods are safe to invoke. Network attackers can exploit this without authentication or user interaction to call unintended methods on Command instances, potentially bypassing application-level authorization. Patches are available in turbo_boost-commands versions 0.1.3 and 0.2.2 for both Ruby and JavaScript ecosystems.
Affected products
- hopsoft turbo_boost-commands <0.1.3, >=0.2.0 <0.2.2
- hopsoft @turbo-boost/commands <0.1.3, >=0.2.0 <0.2.2
Timeline
- 2024-03-14: disclosed: Vulnerability disclosed
- 2024-03-15: patched: Patches released: version 0.1.3 (Ruby and NPM), 0.2.2 (Ruby and NPM)