CVE-2024-28181

Executive Summary

CVE-2024-28181 is a critical security vulnerability in the turbo_boost-commands Ruby gem, which provides commands for building reactive applications with Rails and Hotwire. The vulnerability stems from inadequate authorization checks that allow a sophisticated attacker to invoke methods beyond the intended public interface. While the library attempts to restrict method invocation to public methods on Command classes, the checks are not robust enough, potentially leading to arbitrary code execution or unauthorized actions. The CVSS score of 8.1 (High) reflects the potential for significant impact on confidentiality, integrity, and availability. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the nature of the vulnerability.

Supply Chain & Package Security

This vulnerability affects the Ruby gem turbo_boost-commands, which is distributed via RubyGems. Organizations using this gem in their Rails applications should verify their dependency versions and upgrade immediately. The gem is part of the Ruby ecosystem, and supply chain risks include compromised gem versions or malicious updates. Ensure that gem signatures and checksums are verified where possible.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, making it a high-priority target for attackers. The low attack complexity suggests that exploitation does not require specialized conditions.

Deep Dive & Mechanics

The turbo_boost-commands gem allows developers to define Command classes that are invoked via Hotwire. The library includes a mechanism to verify that only public methods on Command classes can be called. However, the verification logic is flawed:

1. Class Verification: The library checks that the target class is a Command subclass.
2. Method Verification: It checks that the requested method is defined as a public method.

The weakness is that this check does not account for methods inherited from parent classes or modules, nor does it prevent invocation of methods that are public but not intended to be exposed (e.g., internal utility methods). An attacker can craft a request that invokes a method that, while public, performs sensitive operations such as file access, database manipulation, or system command execution.

The attack surface includes any Rails application using turbo_boost-commands with exposed Command classes. The attacker sends a crafted HTTP request (likely via WebSocket or AJAX) that specifies a method name not intended for public invocation.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

class Command
  def self.invoke(method_name, params)
    if self < Command && public_method_defined?(method_name)
      new.send(method_name, params)
    else
      raise "Invalid command or method"
    end
  end
end

Patched Code (version 0.1.3/0.2.2):

class Command
  ALLOWED_METHODS = %i[execute perform].freeze

  def self.invoke(method_name, params)
    if self < Command && ALLOWED_METHODS.include?(method_name.to_sym)
      new.send(method_name, params)
    else
      raise "Invalid command or method"
    end
  end
end

The patched version introduces an explicit allowlist of safe methods (e.g., execute, perform), preventing invocation of arbitrary public methods.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Rails application using turbo_boost-commands version < 0.1.3 or < 0.2.2.
• Knowledge of a Command class and its public methods.

Exploitation Steps:

1. Identify the target application and its Command classes (e.g., via source code disclosure or error messages).
2. Craft a request to invoke a sensitive public method, such as system, exec, or send.
3. Example payload (assuming a Command class AdminCommand):

   {
     "command": "AdminCommand",
     "method": "system",
     "params": "id"
   }
   

4. Send the request via the application's Hotwire endpoint.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unusual method names in Hotwire requests.
• Log all invocations of Command methods and alert on unexpected patterns.
• Use the detection rules below.

Mitigation:

• Upgrade to patched versions immediately.
• If unable to upgrade, apply the workaround from the repository GHSA (e.g., override the invoke method to enforce an allowlist).

Indicators of Compromise (IOCs)

• Network: HTTP requests to Hotwire endpoints with unusual method parameters (e.g., system, exec, send, eval).
• Logs: Application logs showing invocations of methods not in the allowlist.
• File System: Unexpected file modifications or creation of files in the application directory.
• Process: Unusual child processes spawned by the Rails application (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2024_28181_TurboBoost_Commands {
    meta:
        description = "Detects exploitation attempts of CVE-2024-28181 in turbo_boost-commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28181"
    strings:
        $method1 = "system" nocase
        $method2 = "exec" nocase
        $method3 = "send" nocase
        $method4 = "eval" nocase
        $command_class = "Command" nocase
    condition:
        any of ($method*) and $command_class
}

Sigma Rule

title: CVE-2024-28181 TurboBoost Commands Method Invocation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to invoke sensitive methods via turbo_boost-commands
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: rails
detection:
    selection:
        http.method: POST
        http.url|contains: "/hotwire"
        http.body|contains:
            - "system"
            - "exec"
            - "send"
            - "eval"
    condition: selection
falsepositives:
    - Legitimate use of methods named similarly (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28181 TurboBoost Commands Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/hotwire"; http_uri; content:"system"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to turbo_boost-commands version 0.1.3 or 0.2.2.
2. Workaround: If upgrade is not possible, implement a custom authorization check in your Command classes to restrict allowed methods.
3. Long-term: Review all Command classes and ensure only intended methods are public. Consider using a whitelist approach for method invocation.
4. Monitoring: Enable logging of all Command invocations and alert on anomalies.
5. Patch Management: Regularly update dependencies and monitor for security advisories.

Valters IT