PT-2024-9137 · Unknown · Ashpostgres
Rapidfsub
·
Published
2024-10-23
·
Updated
2024-10-25
·
CVE-2024-49756
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
AshPostgres versions 2.0.0 through 2.4.9
Description:
The issue is related to the skipping of policies in update actions under specific conditions, allowing side effects to be triggered when they should not have been. This occurs only on "empty" update actions with no changing fields. To be vulnerable, an affected user must have an update action that meets certain criteria, including being on a resource with no attributes containing an "update default", being performable atomically, not having
require atomic? false, having at least one authorizer, and having at least one change. The problem does not allow reading new data that the user should not have had access to, only triggering a side effect a user should not have been able to trigger.Recommendations:
To resolve the issue for versions 2.0.0 through 2.4.9, update to version 2.4.10 of ash postgres.
As a temporary workaround, consider adding
require atomic? false to any potentially affected update action.
Alternatively, replace any usage of Ash.update with Ash.bulk update for an affected action.
Another option is to add an update timestamp to the action.
Determine that none of the actions are vulnerable using the provided script.Exploit
Fix
Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ashpostgres