AshAdmin 1.3.1 修复 CVE-2026-8272：未授权 LiveView 事件触发 Atom 表耗尽 DoS

漏洞关键信息总结 漏洞概述 漏洞名称：Atom-table exhaustion DoS in 漏洞类型：通过向 发送包含大量唯一键的 事件，导致 BEAM atom 表耗尽，从而引发 DoS（拒绝服务） 触发方式：攻击者通过反复提交 事件，事件携带任意键（arbitrary keys），使 atom 表达到上限，导致整个 Erlang VM 崩溃（LiveView 进程崩溃） 严重等级：High（CVSS 8.3/10） CVE 编号：CVE-2026-8272 受影响版本： 修复版本： 攻击向量：Network 攻击复杂度：Low 影响：未认证的 LiveView 事件可耗尽 atom 表，导致 LiveView 进程崩溃，影响所有暴露 AshAdmin 服务的应用 影响范围 任何运行 AshAdmin 的应用 未认证的 LiveView 事件即可触发 导致整个 Erlang VM 崩溃，影响所有暴露 AshAdmin 服务的应用 修复方案 升级至 1.3.1 版本 修复方式：在 中添加对键的验证/限制，避免未认证请求耗尽 atom 表 POC 代码 ```elixir POC: ash_admin 1.3.0 - unbounded atom creation from client-controlled form keys in the calculate LiveView component (lib/ash_admin/components/resource/show.ex:750-762). A threat model: an unauthenticated attacker who can reach the AshAdmin LiveView socket. This script stands up a real Phoenix application (Ranch) mounting AshAdmin's router, loads a record's show page over HTTP like a browser. Then opens a raw WebSocket to /live, joins the showview channel, and pushes a hand-crafted calculate event for string keys at the Show View's calculate. The event's name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), so even a non-enum calculation name (e.g. Enum.Foo.calculation) is attacker-chosen; ash_admin runs every key in the through String_to_atom/1 below (line 762), s

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

AshAdmin 1.3.1 修复 CVE-2026-8272：未授权 LiveView 事件触发 Atom 表耗尽 DoS

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

AshAdmin 1.3.1 修复 CVE-2026-8272：未授权 LiveView 事件触发 Atom 表耗尽 DoS

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！