[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-28121":3,"landing-articles":77},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":38,"references":41,"score":52,"epss_score":53,"epss_percentile":54,"is_kev":55,"cisa_kev_date_added":56,"cisa_kev_due_date":56,"cisa_ssvc":57,"attack_mappings":67,"exploits":74},39340,"CVE-2024-28121","EUVD-2024-0913","StimulusReflex arbitrary method call\n\n### Summary\nMore methods than expected can be called on reflex instances. Being able to call some of them has security implications.\n\n### Details\nTo invoke a reflex a websocket message of the following shape is sent:\n```json\n{ \n  \"target\": \"[class_name]#[method_name]\", \n  \"args\": [] \n}\n```\nThe server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`.\nIt then attempts to call `method_name` on the instance with the provided arguments [ref](https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fblob\u002F0211cad7d60fe96838587f159d657e44cee51b9b\u002Fapp\u002Fchannels\u002Fstimulus_reflex\u002Fchannel.rb#L83):\n\n```ruby\nmethod = reflex.method method_name\nrequired_params = method.parameters.select { |(kind, _)| kind == :req }\noptional_params = method.parameters.select { |(kind, _)| kind == :opt }\n\nif arguments.size >= required_params.size && arguments.size \u003C= required_params.size + optional_params.size\n  reflex.public_send(method_name, *arguments)\nend\n```\n\nThis is problematic as `reflex.method(method_name)` can be more methods than those explicitly specified by the developer in their reflex class. A good example is the `instance_variable_set` method.\n\n\u003Cdetails>\n\n\u003Csummary>Read more\u003C\u002Fsummary>\nLet's imagine a reflex that uses `@user` as a trusted variable in an `after_reflex` callback.\n\nThis variable can be overwritten using the following message:\n```json\n{\n  \"target\": \"ChatReflex#instance_variable_set\", \n  \"args\": [\"@user\", \"\u003Cadmin-id>\"]\n}\n```\n\nHere are other interesting methods that were found to be available for the [ChatReflex sample reflex](https:\u002F\u002Fgithub.com\u002Fhopsoft\u002Fstimulus_reflex_expo\u002Fblob\u002Fdcce8c36a6782d1e7f57f0e2766a3f6fd770b3b1\u002Fapp\u002Freflexes\u002Fchat_reflex.rb)\n- `remote_byebug`: bind a debugging server\n- `pry`: drop the process in a REPL session\n\nAll in all, only counting  `:req` and `:opt` parameters helps.\nFor example around [version 1.0](https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fblob\u002F1f610b636abfed27de2c61104aebd1ac98180d5b\u002Flib\u002Fstimulus_reflex\u002Fchannel.rb#L41) only `.arity` was checked which allowed access to the `system` method (`.arity == -1`)\n```json\n{\n  \"target\": \"ChatReflex#system\", \n  \"args\": [\"[command here]\"]\n}\n```\nUsing `public_send` instead of `send` does not help but the following payloads **do not** work since `:rest` parameters are not counted in the current version\n```json\n{\n  \"target\": \"ChatReflex#send\", \n  \"args\": [\"system\", \"[command here]\"] \n}\n```\n```json\n{ \n  \"target\": \"ChatReflex#instance_eval\", \n  \"args\": [\"system('[command here]')\"]\n}\n```\n\n\u003C\u002Fdetails>\n\nPre-versions of 3.5.0 added a `render_collection` method on reflexes with  a `:req` parameter. Calling this method could lead to arbitrary code execution:\n```json\n{\n  \"target\": \"StimulusReflex::Reflex#render_collection\", \n  \"args\": [\n    { \"inline\":  \"\u003C% system('[command here]') %>\" }\n  ]\n}\n```\n\n### Patches\n\nPatches are [available on RubyGems](https:\u002F\u002Frubygems.org\u002Fgems\u002Fstimulus_reflex) and on [NPM](https:\u002F\u002Fnpmjs.org\u002Fpackage\u002Fstimulus_reflex). \n\nThe patched versions are: \n- [`3.4.2`](https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Freleases\u002Ftag\u002Fv3.4.2)\n- [`3.5.0.rc4`](https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Freleases\u002Ftag\u002Fv3.5.0.rc4)\n\n### Workaround\n\nYou can add this guard to mitigate the issue if running an unpatched version of the library. \n\n1.) Make sure all your reflexes inherit from the `ApplicationReflex` class\n2.) Add this `before_reflex` callback to your `app\u002Freflexes\u002Fapplication_reflex.rb` file:\n\n```ruby\nclass ApplicationReflex \u003C StimulusReflex::Reflex\n  before_reflex do\n    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]\n    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }\n\n    raise ArgumentError.new(\"Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors\") if !allowed\n  end\nend\n```","2024-03-12T15:44:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":15,"userInteraction":17,"attackComplexity":18,"availabilityImpact":15,"privilegesRequired":18,"confidentialityImpact":15},"UNCHANGED","3.1",8.8,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","NONE","LOW",true,[21],"CWE-470",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:*","cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:*","cpe:2.3:a:stimulus_reflex:stimulus_reflex:*:*:*:*:*:*:*:*",[39,40],"Stimulusreflex Stimulusrelfex","Stimulus_Reflex Stimulus Reflex",[42,43,44,45,46,47,48,49,50,51],"http:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2024\u002FMar\u002F16","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fblob\u002F0211cad7d60fe96838587f159d657e44cee51b9b\u002Fapp\u002Fchannels\u002Fstimulus_reflex\u002Fchannel.rb#L83","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fcommit\u002F538582d240439aab76066c72335ea92096cd0c7f","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Freleases\u002Ftag\u002Fv3.4.2","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Freleases\u002Ftag\u002Fv3.5.0.rc4","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fsecurity\u002Fadvisories\u002FGHSA-f78j-4w3g-4q65","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-28121","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex\u002Fcommit\u002Fd823d7348f9ca42eb6df25574f11974e4f5bc88c","https:\u002F\u002Fgithub.com\u002Frubysec\u002Fruby-advisory-db\u002Fblob\u002Fmaster\u002Fgems\u002Fstimulus_reflex\u002FCVE-2024-28121.yml","https:\u002F\u002Fgithub.com\u002Fstimulusreflex\u002Fstimulus_reflex",0.79,0.01555,0.74981,false,null,{"timestamp":58,"automatable":59,"tech_impact":60,"exploitation":61,"cisa_decision":62,"cisa_remediation_timeline":66},"2024-03-13T14:29:13.739952Z","no","total","none",{"vector":63,"decision":64,"priority":65},"CISAv1\u002FE:N\u002FA:N\u002FT:T\u002FM:H\u002F2026-10-25T19:38:26.484994\u002F","track_star","medium","14D",[68],{"name":69,"source":70,"tactics":71,"technique_id":73},"Exploit Public-Facing Application","attack_vector",[72],"initial-access","T1190",[75,76],{"link":42},{"link":47},{"count":78,"next":79,"previous":56,"results":80},30,"http:\u002F\u002Fweb:8606\u002Fapi\u002Farticles\u002F?page=2&sorted_by=-published_at",[81,88,96,104,111,118,125,130,137,144],{"id":78,"title":82,"summary":83,"published_at":84,"type":85,"link":86,"image_url":87},"PHP2Shell: Two Critical RCE Flaws in PHP (CVSS 9.2)","Unauthenticated code execution demonstrated on WordPress, Drupal and Joomla, and reproduced in our lab. Patched versions and steps to take today.","2026-10-22T00:00:00Z","cve","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fc0615c4ee6-1792684469\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2.png",{"id":89,"title":90,"summary":91,"published_at":92,"type":93,"link":94,"image_url":95},29,"Manage External Security Across All Your Entities","Centralize the management of entities, users and external security resources while maintaining strict data isolation with Patrowl.","2026-09-15T00:00:00Z","security tips","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fmulti-entity-external-security-how-structure-governance-group-level","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F8b2c0cc5eb-1789551467\u002Fvisu_1_multi_tenancy_dark_1x.webp",{"id":97,"title":98,"summary":99,"published_at":100,"type":101,"link":102,"image_url":103},28,"Will AI Become the Next Hacker? Bruce Schneier Answers at DEF CON 34","Tax law, finance, legislation: Bruce Schneier shows how AI could hack human rule systems just as easily as it hacks software.","2026-09-14T00:00:00Z","hacks","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fbruce-schneier-def-con-34","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F5c616d9db4-1789462598\u002Fai-hacker.en.png",{"id":105,"title":106,"summary":107,"published_at":108,"type":93,"link":109,"image_url":110},27,"Exposure Management: definition, stakes, and how it works","Vulnerabilities, misconfigurations, poorly managed identities: understand what Exposure Management is and why it matters in 2026.","2026-09-10T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fdefinition-exposure-management","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F06170638a9-1789050834\u002Fexposure.management.definition.en.png",{"id":112,"title":113,"summary":114,"published_at":115,"type":101,"link":116,"image_url":117},26,"DGFiP Cyberattack 2026: Inside the Attacker","Two distinct attacks hit France","2026-08-17T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fdgfip-cyberattack-2026-inside-attacker-mind","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fdc38d33696-1787055371\u002Fdgfip-2026.png",{"id":119,"title":120,"summary":121,"published_at":122,"type":85,"link":123,"image_url":124},25,"CVE-2026-64638: XSS2Shell, a WordPress Login Vulnerability","Pre-auth XSS on wp-login.php, patched August 6. What is actually exploitable, and how to read it in your Patrowl report.","2026-08-10T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fxss2shell-critical-wordpress-login-vulnerability-2026","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F904e61748b-1786369212\u002Fxss2shell.png",{"id":126,"title":127,"summary":127,"published_at":122,"type":85,"link":128,"image_url":129},24,"CVE-2026-64638 : XSS2Shell, faille du login WordPress","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fcve-2026-64638-xss2shell-faille-login-wordpress","",{"id":131,"title":132,"summary":133,"published_at":134,"type":85,"link":135,"image_url":136},23,"How Agentic AI Hunts Down CVEs Before Attackers Do","38 vulnerability sources monitored around the clock, pentester-validated proof of exploitability, an alert within hours. See how it works.","2026-08-05T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fproactive-threat-hunting-agentic-ai-cve","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F804988ce7b-1785930160\u002Fproactive-threat-hunting-how-agentic-ai-tracks-cves.png",{"id":138,"title":139,"summary":140,"published_at":141,"type":101,"link":142,"image_url":143},22,"AI Agent Incident: OpenAI HuggingFace — Risks and Lessons","An autonomous AI agent escaped its sandbox via a JFrog Artifactory zero-day, compromised HuggingFace via privilege escalation and stolen credentials. Reconstructed timeline and security lessons.","2026-07-31T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fai-agent-incident-openai-huggingface-risks","[Image URL from Kirby]",{"id":145,"title":146,"summary":147,"published_at":148,"type":93,"link":149,"image_url":150},21,"SaaS Under Watch: What Your SDLC Doesn","Your pipeline is green. Your real exposure may have changed without you knowing it. The complete guide for software vendors.","2026-07-29T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fsecuring-saas-application-software-vendor","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F20d6ec0cd0-1785331401\u002Fapplication-security.png"]