From 81353c449ddc4e7ec37ea0fcac30a818f4dd0f03 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 16 Mar 2024 19:21:23 -0400
Subject: [PATCH] GHSA SYNC: 1 brand new advisory (#766)

---------

Co-authored-by: Postmodern <postmodern.mod3@gmail.com>
---
 gems/turbo_boost-commands/CVE-2024-28181.yml | 61 ++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 gems/turbo_boost-commands/CVE-2024-28181.yml

diff --git a/gems/turbo_boost-commands/CVE-2024-28181.yml b/gems/turbo_boost-commands/CVE-2024-28181.yml
new file mode 100644
index 0000000000..4593c9eeab
--- /dev/null
+++ b/gems/turbo_boost-commands/CVE-2024-28181.yml
@@ -0,0 +1,61 @@
+---
+gem: turbo_boost-commands
+cve: 2024-28181
+ghsa: mp76-7w5v-pr75
+url: https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+title: TurboBoost Commands vulnerable to arbitrary method invocation
+date: 2024-03-15
+description: |
+  ### Impact
+
+  TurboBoost Commands has existing protections in place to
+  guarantee that only public methods on Command classes can be invoked; however, the
+  existing checks aren't as robust as they should be. It's possible for a sophisticated
+  attacker to invoke more methods than should be permitted depending on the the strictness
+  of authorization checks that individual applications enforce. Being able to call
+  some of these methods can have security implications.
+
+  #### Details
+
+  Commands verify that the class must be a `Command` and that the method requested is
+  defined as a public method; however, this isn't robust enough to guard against all
+  unwanted code execution. The library should more strictly enforce which methods are
+  considered safe before allowing them to be executed.
+
+  ### Patches
+
+  Patched in the following versions.
+  - 0.1.3
+    - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.1.3)
+    - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.1.3)
+  - 0.2.2
+    - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.2.2)
+    - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.2.2)
+
+  ### Workarounds
+
+  You can add this guard to mitigate the issue if running an unpatched
+  version of the library.
+
+  ```ruby
+  class ApplicationCommand < TurboBoost::Commands::Command
+    before_command do
+      method_name = params[:name].include?(\"#\") ? params[:name].split(\"#\").last : :perform
+      ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1]
+      allowed = ancestors.any? { |a| a.public_instance_methods(false).any? method_name.to_sym }
+      throw :abort unless allowed # ← blocks invocation
+      # raise \"Invalid Command\" unless allowed # ← blocks invocation
+    end
+  end
+  ```
+cvss_v3: 8.1
+patched_versions:
+  - "~> 0.1.3"
+  - ">= 0.2.2"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28181
+    - https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+    - https://github.com/hopsoft/turbo_boost-commands/commit/337cda7d9222f1f449905454a7374222017a7477
+    - https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba
+    - https://github.com/advisories/GHSA-mp76-7w5v-pr75