Ash Framework Aggregation Bypasses Read Policy in User Filters (BQL/BOLA)

Ash.count, Ash.exists, and Ash.aggregate skip related read policies in user filters Vulnerability Overview Ash.count, Ash.exists, and Ash.aggregate contain a vulnerability in how they apply related resource read policies. When a query crosses a relationship via a user-supplied filter ( ), either by directly filtering the related resource's body (e.g., comments body) or by applying a public aggregate (e.g., first author, comments body, etc.), the read policy of the related resource is not applied. Although read policies are enforced for the same resource, any user who cannot read the related resource can still confirm whether a matching row exists, regardless of the filters they choose. Only early versions of 3.34.5 and 3.33.3 were confidentially patched; earlier versions were not checked. The root cause is that ( ) skips the , , and steps, which constitute the read path steps. Scope Affected Versions: >= 2.6.0, "secret"}}}, {"first_body", %{first_body: %{"body" => "secret"}}}, {"first_body", %{first_body: %{"body" => "secret"}}} ] fn m, o -> Ash.Query.filter(AggregatePost, m) fn m, o -> Ash.aggregate(AggregatePost, m, o) end end) fn m, o -> Ash.count(AggregatePost, m, o) end end) fn m, o -> Ash.exists?(AggregatePost, m, o) end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "count") end end) fn m, o -> Ash.aggregate(AggregatePost, m, o, {:list, field: :title}, operation: "cou

Goal Reached Thanks to every supporter — we hit 100%!

Ash Framework Aggregation Bypasses Read Policy in User Filters (BQL/BOLA)

More from this source