Vulnerability in Hopsoft Turbo Boost-Commands
CVE-2024-28181
turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. This issue has been addressed in versions 0.1.3, and 0.2.2. Users are advised to upgrade. Users unable to upgrade should see the repository GHSA for workaround advice.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Hopsoft Turbo Boost-Commands — versions < 0.1.3, >= 0.2.0, < 0.2.2
- Turboboost Commands Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-28181?
- CVE-2024-28181 is a high-severity vulnerability in Hopsoft Turbo Boost-Commands, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.1/10. Published 2024-03-14.
- How severe is CVE-2024-28181?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2024-28181 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.