Skip to content
Fencer Vulns
high 8.8

CVE-2024-28121 json

Reflex arbitrary method call in stimulus_reflex

published 2024-03-12 2 y ago modified 2026-09-10 1 mo ago also GHSA-f78j-4w3g-4q65 , EUVD-2024-0913

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.

Patch / fix

  • rubygems stimulus_reflex 3.4.2, 3.5.0.rc4
  • npm stimulus_reflex 3.4.2, 3.5.0-rc4
  • stimulusreflex stimulus_reflex 3.4.2, 3.5.0.rc4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.55% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2024/Mar/16 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems stimulus_reflex
>=3.5.0.pre0, <3.5.0.rc4
<3.4.2
3.5.0.rc4
3.4.2
npm stimulus_reflex
>=3.5.0-pre0, <3.5.0-rc4
<3.4.2
3.5.0-rc4
3.4.2

Affected products

  • stimulusreflex stimulus_reflex

Classification

Weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.