Maennchen

An incorrect authorization issue exists in ash-project ash, allowing authentication bypass. The issue is associated with the program files `lib/ash/policy/authorizer/authorizer.ex` and the `Elixir.Ash.Policy.Authorizer`:strict filters/2 routine.

The issue concerns a CSV Injection Vulnerability in the CSV Exports feature of the Hygeia application, which is used for collecting and processing personal and case data related to communicable diseases. This vulnerability allows users to submit formulas as exported fields, which are then executed when the exported file is ingested. The lack of validation or sanitization of these formula fields enables malicious actors to construct and execute malicious code.

A cross-site scripting (XSS) issue was discovered, allowing for potential exploitation via the `order` parameter in a query. An example of a malicious request could be made to the API endpoint "http://host/ressources?order=%27><script>alert(1);</script>", demonstrating the vulnerability.