Phoenix
Monthly
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 before 5.0.0-rc.14) allows an attacker who has pre-planted a session identifier in a victim's browser to ride that identifier into the victim's authenticated session. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with survives into their logged-in session through every authentication path, including the default success/4, the mix ash_authentication_phoenix.install AuthController, and remember-me auto-login; logout does not close the window because clear_session/2 ends with Plug.Conn.clear_session/1, which wipes contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. Exploitation is conditional rather than universal: it requires a server-side session store where a rotatable identifier exists (deployments on Phoenix's default signed-cookie session store are largely unaffected, as there is no identifier to fixate), a means of planting the session cookie in the victim's browser, and victim interaction to sign in. No public exploit was identified at time of analysis, although the upstream fix commits and their accompanying regression tests are public.
Denial of service in the Phoenix Framework (Elixir) affects any endpoint mounting a Phoenix.Socket with a reachable WebSocket or LongPoll channel transport, in versions from 0.11.0 up to the fixed 1.5.15, 1.6.17, 1.7.24, and 1.8.9. Because transports place no cap on channels joined per connection, one unauthenticated client can stream unlimited phx_join messages down a single connection to spawn hundreds of thousands of channel processes and exhaust the BEAM process table, taking the whole node offline. Rated CVSS 4.0 8.7 (availability-only impact); no public exploit identified at time of analysis, though the mechanics are described in detail in the vendor advisory.
Unauthenticated remote denial-of-service in Phoenix Framework 1.7.0-1.7.21 and 1.8.0-1.8.5 allows attackers to crash Elixir BEAM nodes by sending multi-megabyte HTTP requests filled with newlines to the long-poll transport endpoint. A 1 MB payload of newline characters triggers allocation of approximately one million empty list elements, exhausting scheduler and memory resources. Session token required to trigger the vulnerability is obtainable via unauthenticated GET request, making exploitation trivial. Vendor-released patches (1.7.22, 1.8.6) enforce client-side batching limits. CVSS 8.7 (high availability impact) confirmed; no public exploit or CISA KEV listing identified at time of analysis.
Filesystem path disclosure in Tidewave Phoenix 0.8.0 through 0.9.1 lets a hostile web page read the framework's configuration tag - including the application root path, Mix dependency paths, project name and local port - either from the /tidewave/connect JSON response or from the toolbar meta tag injected into rendered HTML pages. Neither response validates the Host header, so a page that DNS-rebinds its own domain to the loopback address can retrieve the tag with a same-origin request, which carries no Origin header, exposing the developer's local username and project layout. The issue is unauthenticated per the CVSS vector but requires the victim to visit the attacker's page; impact is limited to low-sensitivity reconnaissance (confidentiality only, no code execution or access gain), no public exploit code was identified at time of analysis, and the vendor fix is version 0.9.2.
Phoenix Framework's Presence JavaScript client allows any user with ordinary channel access to permanently break presence synchronization for all other viewers of an affected channel topic. By joining a channel using a key name that collides with an Object.prototype property (such as '__proto__', 'constructor', or 'toString'), an attacker causes an uncaught TypeError inside Presence.syncState and Presence.syncDiff that halts all further presence updates for every connected viewer until the attacker disconnects. This is not in CISA KEV, no public exploit has been identified, and the CVSS 4.0 score of 6.3 reflects the limited but persistent client-side availability impact with no server-side exposure.
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 before 5.0.0-rc.14) allows an attacker who has pre-planted a session identifier in a victim's browser to ride that identifier into the victim's authenticated session. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with survives into their logged-in session through every authentication path, including the default success/4, the mix ash_authentication_phoenix.install AuthController, and remember-me auto-login; logout does not close the window because clear_session/2 ends with Plug.Conn.clear_session/1, which wipes contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. Exploitation is conditional rather than universal: it requires a server-side session store where a rotatable identifier exists (deployments on Phoenix's default signed-cookie session store are largely unaffected, as there is no identifier to fixate), a means of planting the session cookie in the victim's browser, and victim interaction to sign in. No public exploit was identified at time of analysis, although the upstream fix commits and their accompanying regression tests are public.
Denial of service in the Phoenix Framework (Elixir) affects any endpoint mounting a Phoenix.Socket with a reachable WebSocket or LongPoll channel transport, in versions from 0.11.0 up to the fixed 1.5.15, 1.6.17, 1.7.24, and 1.8.9. Because transports place no cap on channels joined per connection, one unauthenticated client can stream unlimited phx_join messages down a single connection to spawn hundreds of thousands of channel processes and exhaust the BEAM process table, taking the whole node offline. Rated CVSS 4.0 8.7 (availability-only impact); no public exploit identified at time of analysis, though the mechanics are described in detail in the vendor advisory.
Unauthenticated remote denial-of-service in Phoenix Framework 1.7.0-1.7.21 and 1.8.0-1.8.5 allows attackers to crash Elixir BEAM nodes by sending multi-megabyte HTTP requests filled with newlines to the long-poll transport endpoint. A 1 MB payload of newline characters triggers allocation of approximately one million empty list elements, exhausting scheduler and memory resources. Session token required to trigger the vulnerability is obtainable via unauthenticated GET request, making exploitation trivial. Vendor-released patches (1.7.22, 1.8.6) enforce client-side batching limits. CVSS 8.7 (high availability impact) confirmed; no public exploit or CISA KEV listing identified at time of analysis.
Filesystem path disclosure in Tidewave Phoenix 0.8.0 through 0.9.1 lets a hostile web page read the framework's configuration tag - including the application root path, Mix dependency paths, project name and local port - either from the /tidewave/connect JSON response or from the toolbar meta tag injected into rendered HTML pages. Neither response validates the Host header, so a page that DNS-rebinds its own domain to the loopback address can retrieve the tag with a same-origin request, which carries no Origin header, exposing the developer's local username and project layout. The issue is unauthenticated per the CVSS vector but requires the victim to visit the attacker's page; impact is limited to low-sensitivity reconnaissance (confidentiality only, no code execution or access gain), no public exploit code was identified at time of analysis, and the vendor fix is version 0.9.2.
Phoenix Framework's Presence JavaScript client allows any user with ordinary channel access to permanently break presence synchronization for all other viewers of an affected channel topic. By joining a channel using a key name that collides with an Object.prototype property (such as '__proto__', 'constructor', or 'toString'), an attacker causes an uncaught TypeError inside Presence.syncState and Presence.syncDiff that halts all further presence updates for every connected viewer until the attacker disconnects. This is not in CISA KEV, no public exploit has been identified, and the CVSS 4.0 score of 6.3 reflects the limited but persistent client-side availability impact with no server-side exposure.
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.