Ash Cloak
Monthly
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. No public exploit is identified at time of analysis.
Unsafe Erlang term deserialization in ash_cloak 0.1.0-0.3.x allows an attacker who can influence encrypted column bytes to crash the BEAM runtime node via unbounded atom table exhaustion or a decompression bomb. Applications configured with Cloak's unauthenticated AES.CTR cipher are the highest-risk targets: an authenticated application user who knows their own plaintext can XOR-derive the keystream and write a forged ciphertext of equal length without the encryption key, causing the deserialization to fire on any subsequent column read. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the patch commit confirms two distinct, low-skill attack primitives against unpatched deployments.
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. No public exploit is identified at time of analysis.
Unsafe Erlang term deserialization in ash_cloak 0.1.0-0.3.x allows an attacker who can influence encrypted column bytes to crash the BEAM runtime node via unbounded atom table exhaustion or a decompression bomb. Applications configured with Cloak's unauthenticated AES.CTR cipher are the highest-risk targets: an authenticated application user who knows their own plaintext can XOR-derive the keystream and write a forged ciphertext of equal length without the encryption key, causing the deserialization to fire on any subsequent column read. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the patch commit confirms two distinct, low-skill attack primitives against unpatched deployments.