Ash Oban
Monthly
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. No public exploit has been identified at time of analysis, though the mechanism is straightforward and fully documented by the vendor advisory GHSA-gj9p-x393-rf9h.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. No public exploit has been identified at time of analysis, though the mechanism is straightforward and fully documented by the vendor advisory GHSA-gj9p-x393-rf9h.