PT-2026-67224 · Unknown · Ueberauth Guardian
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
Name of the Vulnerable Software and Affected Versions
ueberauth guardian versions 2.0.0 through 2.4.0
Description
An allocation of resources without limits or throttling in the
Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. The Guardian.Permissions mixin installs a public encode permissions!/1 function that calls String.to atom(to string(k)) for each key of a supplied map before validation. In the do encode permissions!/2 function, the integer-value clause bypasses validation against the configured permission set, allowing keys with integer values to be interned as new atoms. Since atoms are not garbage collected and the BEAM atom table has a fixed size, an attacker who can influence a permission map passed to encode permissions!/1 or encode permissions into claims!/2 can exhaust the table, crashing the BEAM node and all running services. This issue is associated with the file lib/guardian/permissions.ex and the functions encode permissions!/1, encode permissions into claims!/2, and do encode permissions!/2.Recommendations
Update ueberauth guardian to version 2.4.1 or later.
As a temporary workaround, filter the permission map to ensure only keys belonging to the configured permission set are passed to
encode permissions!/1 or encode permissions into claims!/2, and avoid passing attacker-influenced permission maps into these functions.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ueberauth Guardian