CVE-2023-34102 (published 2023-06-05T23:15Z)

Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-470
cwe_name: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
description: The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
extended_description: If the product uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.
         

Fix information:
repo_url: https://github.com/avo-hq/avo
commit_details: repo_url: https://github.com/avo-hq/avo
author: Adrian Marin
author_date: 2023-06-06 01:06:58+03:00
msg: Merge pull request from GHSA-86h2-2g4g-29qx

* fix vuln

* wip
repository: repo_url: https://github.com/avo-hq/avo
repo_name: avo-hq/avo
description: Build Ruby on Rails apps 10x faster
repo_language: Ruby
owner: avo-hq
file_changes: filename: belongs_to_field.rb
change_type: ModificationType.MODIFY
diff: @@ -199,11 +199,13 @@ module Avo
       def fill_field(model, key, value, params)
         return model unless model.methods.include? key.to_sym
 
+        valid_model_class = valid_polymorphic_class params["#{polymorphic_as}_type"]
+
         if polymorphic_as.present?
-          model.send("#{polymorphic_as}_type=", params["#{polymorphic_as}_type"])
+          model.send("#{polymorphic_as}_type=", valid_model_class)
 
           # If the type is blank, reset the id too.
-          if params["#{polymorphic_as}_type"].blank?
+          if valid_model_class.blank?
             model.send("#{polymorphic_as}_id=", nil)
           else
             model.send("#{polymorphic_as}_id=", params["#{polymorphic_as}_id"])
@@ -215,6 +217,12 @@ module Avo
         model
       end
 
+      def valid_polymorphic_class(possible_class)
+        types.find do |type|
+          type.to_s == possible_class.to_s
+        end
+      end
+
       def database_id
         # If the field is a polymorphic value, return the polymorphic_type as key and pre-fill the _id in fill_field.
         return "#{polymorphic_as}_type" if polymorphic_as.present?

programming_language: Ruby