Updated advisory posts against rubysec/ruby-advisory-db@81353c4

Author: jasnow

advisories/_posts/2024-03-15-CVE-2024-28181.md

@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2024-28181 (turbo_boost-commands): TurboBoost Commands vulnerable to arbitrary
+  method invocation'
+comments: false
+categories:
+- turbo_boost-commands
+advisory:
+  gem: turbo_boost-commands
+  cve: 2024-28181
+  ghsa: mp76-7w5v-pr75
+  url: https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+  title: TurboBoost Commands vulnerable to arbitrary method invocation
+  date: 2024-03-15
+  description: |
+    ### Impact
+
+    TurboBoost Commands has existing protections in place to
+    guarantee that only public methods on Command classes can be invoked; however, the
+    existing checks aren't as robust as they should be. It's possible for a sophisticated
+    attacker to invoke more methods than should be permitted depending on the the strictness
+    of authorization checks that individual applications enforce. Being able to call
+    some of these methods can have security implications.
+
+    #### Details
+
+    Commands verify that the class must be a `Command` and that the method requested is
+    defined as a public method; however, this isn't robust enough to guard against all
+    unwanted code execution. The library should more strictly enforce which methods are
+    considered safe before allowing them to be executed.
+
+    ### Patches
+
+    Patched in the following versions.
+    - 0.1.3
+      - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.1.3)
+      - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.1.3)
+    - 0.2.2
+      - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.2.2)
+      - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.2.2)
+
+    ### Workarounds
+
+    You can add this guard to mitigate the issue if running an unpatched
+    version of the library.
+
+    ```ruby
+    class ApplicationCommand < TurboBoost::Commands::Command
+      before_command do
+        method_name = params[:name].include?(\"#\") ? params[:name].split(\"#\").last : :perform
+        ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1]
+        allowed = ancestors.any? { |a| a.public_instance_methods(false).any? method_name.to_sym }
+        throw :abort unless allowed # ← blocks invocation
+        # raise \"Invalid Command\" unless allowed # ← blocks invocation
+      end
+    end
+    ```
+  cvss_v3: 8.1
+  patched_versions:
+  - "~> 0.1.3"
+  - ">= 0.2.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28181
+    - https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+    - https://github.com/hopsoft/turbo_boost-commands/commit/337cda7d9222f1f449905454a7374222017a7477
+    - https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba
+    - https://github.com/advisories/GHSA-mp76-7w5v-pr75
+---