Ash Framework audit_log hashed_password Information Disclosure Analysis

Vulnerability Intelligence Summary Vulnerability Overview Vulnerability Name: The Audit log add-on stores the full actor structure, including , within . Vulnerability Type: Sensitive Information Disclosure (CVSS 3.1 Score 4.1, Low). Root Cause: When writing audit records, the add-on serializes the actor's complete resource structure (which includes ) and stores it in without masking or redacting sensitive fields. Impact Scope Affected Versions: and . Impact Conditions: - The add-on is enabled; - Authenticated users perform actions (such as creating, updating, or deleting resources); - Audit records are persisted to storage backends such as ETS, Mnesia, PostgreSQL/SQLite/MySQL, etc. Impact: Any operator or backup system with read access to the audit tables/logs (e.g., SIEM, log collectors) can obtain password hashes for all active accounts, resulting in sensitive data leakage across users. Remediation Fixed Versions: Fixed in and . Fix Method: The actor structure is collapsed into an opaque string via before serialization, preventing the direct storage of the complete structure. Mitigations: - Disable the add-on; - Upgrade to or higher; - Sanitize existing audit data (e.g., remove or redact the actor field within ). POC / Exploit Code No standalone POC code block is provided on the page, but a code comparison between the pre-fix and post-fix implementations is shown: Pre-Fix ( in v4.0): Here, is the full struct, containing . Post-Fix ( in stable-4.0): By using , the actor is collapsed into an opaque string, preventing the leakage of sensitive fields.

Goal Reached Thanks to every supporter — we hit 100%!

Ash Framework audit_log hashed_password Information Disclosure Analysis

More from this source