CVE-2024-28181

{"id": "CVE-2024-28181", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2024-03-14T18:15:07.107", "references": [{"url": "https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba", "source": "security-advisories@github.com"}, {"url": "https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75", "source": "security-advisories@github.com"}, {"url": "https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": " turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. This issue has been addressed in versions 0.1.3, and 0.2.2. Users are advised to upgrade. Users unable to upgrade should see the repository GHSA for workaround advice."}, {"lang": "es", "value": "turbo_boost-commands es un conjunto de comandos que le ayudar\u00e1n a crear aplicaciones reactivas s\u00f3lidas con Rails y Hotwire. TurboBoost Commands cuenta con protecciones existentes para garantizar que solo se puedan invocar m\u00e9todos p\u00fablicos en las clases Command; sin embargo, los controles existentes no son tan s\u00f3lidos como deber\u00edan ser. Es posible que un atacante sofisticado invoque m\u00e1s m\u00e9todos de los que deber\u00edan permitirse dependiendo del rigor de las comprobaciones de autorizaci\u00f3n que aplican las aplicaciones individuales. Poder llamar a algunos de estos m\u00e9todos puede tener implicaciones de seguridad. Los comandos verifican que la clase debe ser un \"Comando\" y que el m\u00e9todo solicitado est\u00e9 definido como un m\u00e9todo p\u00fablico; sin embargo, esto no es lo suficientemente s\u00f3lido como para proteger contra toda ejecuci\u00f3n de c\u00f3digo no deseado. La librer\u00eda deber\u00eda hacer cumplir m\u00e1s estrictamente qu\u00e9 m\u00e9todos se consideran seguros antes de permitir su ejecuci\u00f3n. Este problema se solucion\u00f3 en las versiones 0.1.3 y 0.2.2. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben consultar el repositorio GHSA para obtener consejos sobre workaround."}], "lastModified": "2024-11-21T09:05:58.393", "sourceIdentifier": "security-advisories@github.com"}