Maennchen

يوجد خلل في عملية التفويض في مشروع ash-project ash، مما يسمح بتجاوز عملية المصادقة. ترتبط المشكلة بملفات البرنامج `lib/ash/policy/authorizer/authorizer.ex` وبالروتين `Elixir.Ash.Policy.Authorizer`:strict filters/2.

The issue concerns a CSV Injection Vulnerability in the CSV Exports feature of the Hygeia application, which is used for collecting and processing personal and case data related to communicable diseases. This vulnerability allows users to submit formulas as exported fields, which are then executed when the exported file is ingested. The lack of validation or sanitization of these formula fields enables malicious actors to construct and execute malicious code.

A cross-site scripting (XSS) issue was discovered, allowing for potential exploitation via the `order` parameter in a query. An example of a malicious request could be made to the API endpoint "http://host/ressources?order=%27><script>alert(1);</script>", demonstrating the vulnerability.