AshCloak unsafe deserialization DoS in <0.4.0 with CVE & PoC

AshCloak Insecure Deserialization Vulnerability Summary Vulnerability Overview Vulnerability Type: Insecure Deserialization Affected Component: ( ) Vulnerability Description: An attacker can construct an encrypted byte stream to trigger unbounded atom creation, causing the BEAM node to crash (atom exhaustion DoS). The decrypted payload is deserialized without the option, allowing an attacker to exhaust node resources via a crafted encrypted byte stream. Scope of Impact Affected Versions: Fixed Version: Severity: CVSS v3 Score 5.9 / 10 (Medium) CWE: CWE-502 (Deserialization of Untrusted Data) Impact: Any application using with a CTR backend (or an unauthenticated vault), or any deployment where database content can be modified, may be permanently denied service until the node is restarted. Remediation Upgrade to version 0.4.0 or higher. Core Fix: When deserializing the decrypted binary data, the Erlang option must be used (i.e., ) to prevent arbitrary code execution and unbounded atom creation. PoC Code (Full Extraction) ```erlang %% PoC: AshCloak decrypts and then calls %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) decodes the decrypted binary with %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (libash_cloakcalculations/decrypt.erl:29) %% Ash.Calculations.Decrypt (

Goal Reached Thanks to every supporter — we hit 100%!

AshCloak unsafe deserialization DoS in <0.4.0 with CVE & PoC

More from this source