Jonatan Männchen

Improper neutralization of escape, meta, or control sequences allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. The software prints strings from the package repository and documentation search service directly to the terminal via `Hex.Shell.info/1` and `Hex.Shell.error/1` without neutralizing control characters. This affects package metadata, configuration snippets in `mix hex.info`, search results in `mix hex.package search` and `mix hex.search`, owner and organization listings, publish and sponsor URLs, the authenticated username in `mix hex.user`, policy identities in `mix hex.policy`, and API error bodies rendered by `Hex.Utils.print error result/1`. An attacker can embed ANSI escape sequences—such as cursor movement, line erase, carriage returns, and OSC 52 clipboard writes—or Unicode bidirectional overrides to forge displayed URLs, package descriptions, and suggested commands, conceal real output, or write to the clipboard. This can be triggered by any developer running a documentation search that surfaces a malicious package.

AshAuthentication allows the disclosure of user password digests to readers of the audit store. The `audit log` add-on builds `extra data` for each entry in the `AshAuthentication.AddOn.AuditLog.Auditor.build extra data/4` function, which takes the `:actor` from the action callback context verbatim. When an audited action is invoked with `actor:` set to a user record, the record—including the `hashed password` attribute—is deposited into the audit entry. While other identities are collapsed via `AshAuthentication.user to subject/1` and parameters are filtered, the actor remains unfiltered. Setting the attribute `sensitive?: true` is ineffective as it only redacts `inspect/1` output and not JSON encoding or raw-term storage. Exploitation requires independent read access to the audit store (e.g., database credentials, backups, or log shippers), enabling offline password attacks against active accounts. Persistence of this data depends on the data layer; raw-term stores keep it verbatim, whereas SQL stores may drop the entry unless the user resource derives `Jason.Encoder`.

A relative path traversal issue in the stdlib zip module allows writing files outside the intended extraction directory when processing a crafted zip archive. The functions `zip:unzip/1,2` and `zip:extract/1,2` use `zip:check dir level/2` to validate entry paths by tracking directory depth with an integer counter. Because the validation only rejects paths where the final counter value is negative, a path like `../x/y` can cause the counter to go negative during traversal and then return to zero, bypassing the check and resolving to a location outside the extraction directory via `add cwd`. This issue is located in the `lib/stdlib/src/zip.erl` file.

The `Plug.Parsers.MULTIPART` request-body parser, used for file uploads and multipart forms, fails to enforce the `:length` budget across all consumed resources. The parser only counts bytes in the part body, ignoring part header bytes and parts with empty bodies. An unauthenticated remote attacker can exploit this by sending a single request containing numerous empty-body file parts with a non-empty filename in the `Content-Disposition`. This process triggers the creation of a temporary file via `Plug.Upload` and retains a `Plug.Upload` struct for each part, leading to unbounded memory growth and exhaustion of disk space and inodes. The issue is linked to the file `lib/plug/parsers/multipart.ex` and the functions `Plug.Parsers.MULTIPART.parse multipart/2`, `Plug.Parsers.MULTIPART.parse multipart headers/5`, `Plug.Parsers.MULTIPART.parse multipart body/4`, and `Plug.Parsers.MULTIPART.parse multipart file/4`.

Improper neutralization of parameter delimiters allows an attacker to inject or override HTTP cookie attributes. The `encode/2` function in `Plug.Conn.Cookies` constructs the Set-Cookie response header by interpolating the cookie value and its path, domain, `same site`, and extra attributes without neutralizing the ';' delimiter. If an application places attacker-controlled data into a cookie value or attribute, such as through the `put resp cookie/4` function, an attacker can inject a ';' to append or override attributes like Domain and Path scope, or remove the Secure and HttpOnly flags. This can lead to cookie tossing and session fixation. While carriage return, line feed, and null bytes are rejected, preventing HTTP response splitting, attribute injection via ';' remains possible.

An unauthenticated attacker can cause a denial of service against any endpoint mounting a Phoenix socket with a reachable channel transport, such as WebSocket or LongPoll. The issue resides in the `Elixir.Phoenix.Socket`:handle in/4 routine within the lib/phoenix/socket.ex file. Because Phoenix transports do not limit the number of channels a single transport process can join, a client can send an unbounded number of phx join messages over one connection. This spawns excessive channel processes, potentially exhausting the BEAM maximum process limit and preventing the virtual machine from starting new processes for legitimate traffic. This amplification occurs within a single connection, rendering network-layer connection caps and rate limiting ineffective.

The Presence JavaScript client in phoenix contains an improper check for unusual conditions that allows an attacker with ordinary channel access to cause a persistent client-side denial of service for all viewers of a presence channel topic. The issue resides in the `assets/js/phoenix/presence.js` file within the `Presence.syncState()` and `Presence.syncDiff()` routines. The client uses a bare truthiness test (`state[key]`) instead of an own-property check to verify if a presence exists. Since presence keys are attacker-controlled, a user can provide a key that matches an `Object.prototype` member name (such as ` proto `, `constructor`, `toString`, or `hasOwnProperty`). This causes the lookup to return the built-in `Object.prototype` instead of `undefined`, leading the code to attempt to read `.metas.map(...)` from the prototype, which throws an uncaught `TypeError`. This exception prevents the local state from updating and stops `onSync()` from firing. Because the server continues to push the malicious key, the synchronization remains broken for all viewers of the topic until the attacker leaves. This is a read-time confusion of the prototype object and not prototype pollution.

URL path injection exists in the Microsoft Graph adapter of Swoosh. The `Swoosh.Adapters.MsGraph` component constructs the Microsoft Graph API request URL by interpolating the sender's email address into the path `/users/{from}/sendMail` without validation or percent-encoding. In applications where the `from` address is derived from untrusted or user-influenced input, an attacker can use URL-special characters such as `/`, `?`, or `#` in the local part of the address to escape the intended path segment. This allows the attacker to rewrite the request path and query string, redirecting the authenticated POST request to other Graph endpoints within the token's scopes using the application's bearer token.

Unauthenticated attackers can exhaust the BEAM memory and crash the server by streaming a large or slow-trickle unary request body. The function `read full body/3` in 'Elixir.GRPC.Server.Adapters.Cowboy.Handler' accumulates every received chunk into a single growing binary without a size cap. Furthermore, if the client omits the `grpc-timeout` header, the per-chunk read timeout is set to infinity, enabling a slow-trickle client to maintain the connection indefinitely while memory consumption increases. A single connection is enough to exhaust server memory and crash the node.

Authenticated attackers can access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. This occurs in the `map request/5` function within `Elixir.GRPC.Server.Transcode` (lib/grpc/server/transcode.ex), where `Map.merge/2` is used with path bindings as the first argument, granting them the lowest merge precedence. Consequently, a request such as 'GET /users/me/profile?user id=victim' or a POST request containing `user id` in the body results in a decoded protobuf struct where the path-bound field is overwritten by the attacker-supplied value. This allows the bypass of handlers using these fields for authorization, ownership checks, or multi-tenancy scoping. This issue requires HTTP-to-gRPC transcoding to be enabled.

Uncontrolled Resource Consumption in the standard library's Version module allows an attacker to cause a denial of service via CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, forcing a super-linear, non-yielding base-10 to arbitrary-precision integer conversion through `String.to integer/1` (also known as `:erlang.binary to integer/1`). This process pins a BEAM scheduler, and larger components can trigger an uncaught `SystemLimitError` that crashes the calling process. A string of approximately one megabyte is sufficient to trigger this issue, and no authentication is required. The issue is reachable via the `parse digits/2` routine in `lib/version.ex` and public entry points including `Version.parse/1`, `Version.parse!/1`, `Version.match?/3`, `Version.compare/2`, and `Version.parse requirement/1`.

Improper neutralization of CRLF (Carriage Return and Line Feed) sequences in HTTP headers allows for HTTP header injection. The function `Tesla.Multipart.add content type param/2` appends caller-supplied strings to the multipart `content type params` list without validating for `r` or ` ` characters. Subsequently, the `Tesla.Multipart.headers/1` function joins these parameters verbatim to construct the outgoing Content-Type header. An attacker providing a parameter containing `r ` can split the header line, enabling the injection of arbitrary headers into the outbound HTTP request. This issue affects applications that forward untrusted input, such as user-supplied charset or parameter strings, into the `Tesla.Multipart.add content type param/2` function. This can lead to forging outbound request headers or potential request smuggling against the upstream server.

An improper handling of highly compressed data allows a denial of service via a decompression bomb in HTTP response bodies. When `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` is used in a middleware pipeline, response bodies are decompressed eagerly without a size limit. The `decompress body/2` function passes the entire response body to `:zlib.gunzip/1` or `:zlib.unzip/1` without capping the output size. Furthermore, the `compression algorithms/1` function splits the `content-encoding` header by commas, and `decompress body/2` recurses for each token. A server providing a `content-encoding` header with multiple gzip tokens can trigger recursive decompression passes, causing exponential data amplification where a small network payload expands into gigabytes of BEAM heap (the memory area used by the Erlang virtual machine), leading to memory exhaustion and crashing or freezing the calling process.

Improper handling of case sensitivity in `Tesla.Middleware.FollowRedirects` allows credential leakage to third-party origins during cross-origin redirects. The middleware attempts to strip security-sensitive headers by comparing them against a lowercase filter list containing `authorization` and `host`. However, because Tesla preserves header keys exactly as provided by the caller without normalization, headers using canonical casing, such as `Authorization`, do not match the lowercase filter and are forwarded to the redirect destination. An attacker who can control the `Location:` response—via their own endpoint, a redirect-open upstream, or a compromised origin—can capture bearer tokens or other authorization materials. This occurs when the application uses `Tesla.Middleware.FollowRedirects` and sets headers with non-lowercase keys.

Improper encoding or escaping of output allows multipart part header injection through unescaped `Content-Disposition` parameter values. The function `part headers for disposition()` interpolates disposition parameters without validating carriage return (`r`), line feed (` `), or double-quote characters. These values are received from the caller via `add field()` (the `name` parameter), `add file()` (the `filename` parameter), and `add file content()` (the `filename` parameter and other disposition options). A double-quote character can close a quoted parameter prematurely, while `r ` sequences can terminate the `Content-Disposition` header to start a new forged header or end the header block to prepend bytes to the part body. Additionally, the default filename path in `add file()` uses `Path.basename()`, which does not strip carriage returns or line feeds.

An issue in Tesla.Adapter.Mint allows for a denial of service via atom table exhaustion. The function `open conn/2` converts the URL scheme of outgoing requests into a BEAM atom using `String.to atom(uri.scheme)` without allow-list validation. BEAM atoms are permanent entries that are not garbage-collected and are limited to a bounded table of approximately 1,048,576 entries. An attacker capable of influencing the request URL—through application-level URL-forwarding features like webhooks, proxies, or importers, or via a Location header when `Tesla.Middleware.FollowRedirects` is active—can create a new atom for each request by varying the scheme string. Once the atom table is full, the virtual machine crashes, resulting in a complete application shutdown.

A missing authorization issue in the `Elixir.Oban.Web.Jobs.DetailComponent` module allows unauthorized job worker substitution. The `handle event("save-job", ...)` handler fails to perform authorization checks, whereas other handlers like cancel, delete, and retry verify privileges using `can?/2`. An authenticated user with `:read only` access can send a forged `save-job` LiveView WebSocket event to overwrite a job's worker field with any other existing `Oban.Worker` module in the application. Consequently, during the next execution attempt, Oban will invoke the `perform/1` function on the module chosen by the attacker instead of the intended one. This occurs when the Oban.Web dashboard is deployed and accessible to users with limited job-management privileges.

Uncontrolled Resource Consumption in the `Elixir.Oban.Web.CronExpr` module allows memory exhaustion through unbounded cron range expansion. An attacker with permissions to schedule cron jobs can submit a malicious cron expression. When a user with dashboard access views the cron job list, the `describe/1` function is called to render the expression. The `parse range/1` function parses range endpoints using `Integer.parse/1` without bounds checks, and the `expand dom parts/1` and `expand dow parts/1` helpers eagerly materialize the range via `Enum.to list/1`. This process can lead to the allocation of approximately 2.4 GB of memory, resulting in the stalling or crashing of the BEAM node (the Erlang Virtual Machine).

Uncontrolled Resource Consumption in the SOCKS5 transport within `src/hackney socks5.erl` allows flooding. While the caller-supplied timeout is applied during the SOCKS5 negotiation phase, the connection upgrade to TLS via the `ssl:connect/2` function defaults to an infinite timeout because the `Timeout` variable is not forwarded. Consequently, a hostile SOCKS5 proxy that completes the handshake and then stalls or sends a partial TLS ServerHello can cause the connecting process to block indefinitely, ignoring the `connect timeout` or `recv timeout` options.

Improper Neutralization of CRLF Sequences, also known as CRLF Injection, allows HTTP Request/Response Splitting. The WebSocket upgrade code in `src/hackney ws.erl` copies the host, path, headers (`ExtraHeaders`), and protocols options from the caller-supplied opts map into the internal `#ws data{}` record in `init/1` and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in `do handshake/1`. Because no CRLF or NUL stripping is performed at these four injection sites, an attacker controlling these options—such as by forwarding URL components or header values from untrusted input into `hackney ws:start link/1`—can inject arbitrary HTTP headers into the outbound WebSocket upgrade request. This can lead to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies.