Devise auth bypass: sign_in_token_via_post default fix

Vulnerability Overview Vulnerability Type: Authentication Bypass / Authentication Policy Flaw Core Issue: The default value of the option is , causing potential authentication failure or unexpected behavior when authenticating via token in POST requests if the option is not explicitly enabled. Impact: Under specific configurations, users may fail to authenticate using a token in the POST body, or the authentication logic may be inconsistent with documentation or expected behavior. Affected Scope Affected Components: - - - Affected Files: - - - - - Affected Versions: and earlier versions (inferred from commit messages) Fix Details Fix Commit: Fix Details: - Changed the default value of from to , ensuring that token-based authentication in POST requests aligns with documentation. - Updated related test cases to ensure tests pass under the new default value. - Modified the and components to ensure that tokens in POST requests are correctly parsed and verified when is set to . Code Changes: - In , changed the default value of from to . - In , adjusted the authentication logic to ensure that tokens in POST requests are correctly parsed and verified when is . - In , updated test cases to ensure tests pass under the new default value. - In and , updated test cases to ensure tests pass under the new default value. POC / Exploitation Code ```ruby In strategy.ex, change the default value of sign_in_token_via_post from false to true defmodule Authentication.Strategy.Password do @moduledoc """ A strategy for authenticating via password. """ use Ash.Resource @doc "The name to use for the sign in action." field :sign_in_token_via_post, :boolean, default: true Was false before the fix @doc "The name to use for the sign in action." field :sign_in_token_action_name, :string, default: "sign_in" @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token_params, :map, default: %{} @doc "The name to use for the sign in action." field :sign_in_token

Goal Reached Thanks to every supporter — we hit 100%!

Devise auth bypass: sign_in_token_via_post default fix

More from this source