{"id":"CVE-2024-28121","summary":"Reflex arbitrary method call in stimulus_reflex","details":"stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\\\"target\\\":\\\"[class_name]#[method_name]\\\",\\\"args\\\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.","aliases":["GHSA-f78j-4w3g-4q65"],"modified":"2026-08-12T03:51:24.300287315Z","published":"2024-03-12T19:44:29.591Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28121.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-470"]},"references":[{"type":"WEB","url":"http://seclists.org/fulldisclosure/2024/Mar/16"},{"type":"WEB","url":"https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83"},{"type":"WEB","url":"https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2"},{"type":"WEB","url":"https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28121.json"},{"type":"ADVISORY","url":"https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28121"},{"type":"FIX","url":"https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stimulusreflex/stimulus_reflex","events":[{"introduced":"0"},{"fixed":"01803ad6a3cf85b6ee01a3b316a3feb206f3863d"},{"introduced":"4b26f314dfbf699e19f9311b1a7bd253bc4eb46c"},{"fixed":"538582d240439aab76066c72335ea92096cd0c7f"},{"fixed":"3de99e49b5bc4bc477d92a3c550eb7b7cf56a8b7"}],"database_specific":{"cpe":["cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"3.4.2"},{"introduced":"3.5.0-pre1"},{"last_affected":"3.5.0-pre1"},{"introduced":"3.5.0-pre10"},{"last_affected":"3.5.0-pre10"},{"introduced":"3.5.0-pre2"},{"last_affected":"3.5.0-pre2"},{"introduced":"3.5.0-pre3"},{"last_affected":"3.5.0-pre3"},{"introduced":"3.5.0-pre4"},{"last_affected":"3.5.0-pre4"},{"introduced":"3.5.0-pre5"},{"last_affected":"3.5.0-pre5"},{"introduced":"3.5.0-pre6"},{"last_affected":"3.5.0-pre6"},{"introduced":"3.5.0-pre7"},{"last_affected":"3.5.0-pre7"},{"introduced":"3.5.0-pre8"},{"last_affected":"3.5.0-pre8"},{"introduced":"3.5.0-pre9"},{"last_affected":"3.5.0-pre9"},{"introduced":"3.5.0-rc1"},{"last_affected":"3.5.0-rc1"},{"introduced":"3.5.0-rc2"},{"last_affected":"3.5.0-rc2"},{"introduced":"3.5.0-rc3"},{"last_affected":"3.5.0-rc3"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["3.5.0-pre1","3.5.0-pre10","3.5.0-pre2","3.5.0-pre3","3.5.0-pre4","3.5.0-pre5","3.5.0-pre6","3.5.0-pre7","3.5.0-pre8","3.5.0-pre9","3.5.0-rc1","3.5.0-rc2","3.5.0-rc3","v3.4.1","v3.5.0.rc3","v3.5.0.rc2","v3.5.0.rc1","v3.5.0.pre10","v3.5.0.pre9","v3.5.0.pre8","v3.5.0.pre7","v3.5.0.pre6","v3.5.0.pre5","v3.5.0.pre4","v3.5.0.pre3","v3.5.0.pre2","v3.5.0.pre1","v3.4.0","v3.4.0.pre9","v3.4.0.pre8","v3.4.0.pre7","v3.4.0.pre6","v3.4.0.pre5","v3.4.0.pre4","v3.4.0.pre3","v3.4.0.pre2","v3.4.0.pre1","v3.4.0.pre0","v3.3.0","v3.3.0.pre6","v3.3.0.pre5","v3.3.0.pre4","v3.3.0.pre3","v3.3.0.pre2","v3.3.0.pre1","v3.3.0.pre0","v3.2.3","v3.2.2","v3.2.2.pre1","v3.2.2.pre0","v3.2.1","v3.2.0","v3.2.0.pre1","v3.2.0-pre0","v3.2.0.pre0","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.0","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.9","v2.1.8","v2.1.7","v2.1.6","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.2","v2.0.1","v2.0.0","v1.1.1","v1.1.0","v1.0.2","v1.0.1","v1.0.0","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0","v0.1.12","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28121.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}