Exposed Dangerous Method or Function Affecting turbo_boost-commands package, versions <0.1.3 >=0.2.0, <0.2.2

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function due to insufficient validation of public methods on Command classes. An attacker can invoke more methods than should be allowed by exploiting the lack of robust checks on method permissions.

This vulnerability can be mitigated by adding a guard to block invocation of unauthorized methods if running an unpatched version of the library.

class ApplicationCommand < TurboBoost::Commands::Command
  before_command do
    method_name = params[:name].include?("#") ? params[:name].split("#").last : :perform
    ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any? method_name.to_sym }
    throw :abort unless allowed # ← blocks invocation
    # raise "Invalid Command" unless allowed # ← blocks invocation
  end
end

• GitHub Commit
• GitHub Commit