Ash Admin
Monthly
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolation, splicing unencoded record primary keys directly into query strings. Attackers who control a record's string primary key - common in Ash applications using slugs or email addresses as identifiers - can craft a key containing query-string metacharacters (e.g., `legitimate-slug&action_type=destroy`) that override URL parameters when an administrator clicks a row-action link, silently redirecting them to an unintended action such as resource destruction. No public exploit code has been identified at time of analysis; exploitation requires write access to a string-keyed Ash resource and active administrator interaction, affecting ash_admin 0.3.0-rc.0 through 1.3.0.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access to execute arbitrary JavaScript in an administrator's browser. Affected are ash_admin versions 0.13.0 through 1.3.1, where the `RelationshipField` and `ManagedRelationshipSelectField` components render database record label fields unescaped via `Phoenix.HTML.raw/1` after applying search-term highlight markup. A crafted label such as `<img src=x onerror=...>` persists in the database and fires whenever an admin's typeahead dropdown displays the matching record, granting the attacker full admin-level privileges over everything AshAdmin exposes. No public exploit code has been identified at time of analysis; a vendor-released patch is available in version 1.3.1.
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin interface to crash the entire BEAM VM node. Two handlers - AshAdmin.PageLive's set_actor and AshAdmin.Components.Resource.Show's calculate - passed unvalidated client strings directly to Module.concat/1 and String.to_atom/1 respectively, minting a permanent new atom per unique request. Because BEAM atoms are never garbage collected and the table is capped at roughly one million entries, flooding either handler terminates the VM and takes down every Elixir application co-hosted on the node. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch version 1.3.1 is available.
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment.
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolation, splicing unencoded record primary keys directly into query strings. Attackers who control a record's string primary key - common in Ash applications using slugs or email addresses as identifiers - can craft a key containing query-string metacharacters (e.g., `legitimate-slug&action_type=destroy`) that override URL parameters when an administrator clicks a row-action link, silently redirecting them to an unintended action such as resource destruction. No public exploit code has been identified at time of analysis; exploitation requires write access to a string-keyed Ash resource and active administrator interaction, affecting ash_admin 0.3.0-rc.0 through 1.3.0.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access to execute arbitrary JavaScript in an administrator's browser. Affected are ash_admin versions 0.13.0 through 1.3.1, where the `RelationshipField` and `ManagedRelationshipSelectField` components render database record label fields unescaped via `Phoenix.HTML.raw/1` after applying search-term highlight markup. A crafted label such as `<img src=x onerror=...>` persists in the database and fires whenever an admin's typeahead dropdown displays the matching record, granting the attacker full admin-level privileges over everything AshAdmin exposes. No public exploit code has been identified at time of analysis; a vendor-released patch is available in version 1.3.1.
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin interface to crash the entire BEAM VM node. Two handlers - AshAdmin.PageLive's set_actor and AshAdmin.Components.Resource.Show's calculate - passed unvalidated client strings directly to Module.concat/1 and String.to_atom/1 respectively, minting a permanent new atom per unique request. Because BEAM atoms are never garbage collected and the table is capped at roughly one million entries, flooding either handler terminates the VM and takes down every Elixir application co-hosted on the node. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch version 1.3.1 is available.
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment.