Description
Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
Summary
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.
When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.
This issue affects ash: from 1.52.0-rc.11 before 3.31.1.
Configurations
A belongs_to relationship must be managed with manage_relationship using on_lookup: :relate, and the lookup value must come from client input.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 hex | | =1.52.0-rc.11 || =1.52.0-rc.12 || =1.52.0-rc.13 || =1.52.0-rc.14 || =1.52.0-rc.15 || =1.52.0-rc.16 || =1.52.0-rc.17 || =1.52.0-rc.18 || =1.52.0-rc.19 || =1.52.0-rc.20 || =1.52.0-rc.21 || =1.52.0-rc.22 || =1.53.0 || =1.53.2 || =1.53.3 || =2.0.0 || =2.0.0-pre.0 || =2.0.0-pre.1 || =2.0.0-pre.2 || =2.0.0-pre.3 || =2.0.0-pre.4 || =2.0.0-pre.5 || =2.0.0-pre.6 || =2.0.0-pre.7 || =2.0.0-pre.8 || =2.0.0-rc.0 || =2.0.0-rc.1 || =2.0.0-rc.10 || =2.0.0-rc.11 || =2.0.0-rc.12 || =2.0.0-rc.13 || =2.0.0-rc.14 || =2.0.0-rc.15 || =2.0.0-rc.2 || =2.0.0-rc.3 || =2.0.0-rc.4 || =2.0.0-rc.5 || =2.0.0-rc.6 || =2.0.0-rc.7 || =2.0.0-rc.8 || =2.0.0-rc.9 || =2.1.0 || =2.10.0 || =2.10.1 || =2.10.2 || =2.11.0 || =2.11.0-rc.0 || =2.11.0-rc.1 || =2.11.0-rc.2 || =2.11.0-rc.3 || =2.11.1 || =2.11.10 || =2.11.11 || =2.11.2 || =2.11.3 || =2.11.4 || =2.11.5 || =2.11.6 || =2.11.7 || =2.11.8 || =2.11.9 || =2.12.0 || =2.12.1 || =2.13.0 || =2.13.1 || =2.13.2 || =2.13.3 || =2.13.4 || =2.14.0 || =2.14.1 || =2.14.10 || =2.14.11 || =2.14.12 || =2.14.13 || =2.14.14 || =2.14.15 || =2.14.16 || =2.14.17 || =2.14.18 || =2.14.19 || =2.14.2 || =2.14.20 || =2.14.21 || =2.14.3 || =2.14.4 || =2.14.5 || =2.14.6 || =2.14.7 || =2.14.8 || =2.14.9 || =2.15.0 || =2.15.1 || =2.15.10 || =2.15.11 || =2.15.12 || =2.15.13 || =2.15.14 || =2.15.15 || =2.15.16 || =2.15.17 || =2.15.18 || =2.15.19 || =2.15.2 || =2.15.20 || =2.15.4 || =2.15.5 || =2.15.6 || =2.15.7 || =2.15.8 || =2.15.9 || =2.16.0 || =2.16.1 || =2.17.0 || =2.17.1 || =2.17.10 || =2.17.11 || =2.17.12 || =2.17.13 || =2.17.14 || =2.17.15 || =2.17.16 || =2.17.17 || =2.17.18 || =2.17.19 || =2.17.2 || =2.17.20 || =2.17.21 || =2.17.22 || =2.17.23 || =2.17.24 || =2.17.3 || =2.17.4 || =2.17.5 || =2.17.6 || =2.17.7 || =2.17.8 || =2.17.9 || =2.18.0 || =2.18.1 || =2.18.2 || =2.19.0 || =2.19.1 || =2.19.10 || =2.19.11 || =2.19.12 || =2.19.13 || =2.19.14 || =2.19.2 || =2.19.3 || =2.19.4 || =2.19.5 || =2.19.6 || =2.19.7 || =2.19.8 || =2.19.9 || =2.2.0 || =2.20.0 || =2.20.1 || =2.20.2 || =2.20.3 || =2.21.0 || =2.21.1 || =2.21.10 || =2.21.11 || =2.21.12 || =2.21.13 || =2.21.14 || =2.21.15 || =2.21.2 || =2.21.3 || =2.21.4 || =2.21.5 || =2.21.6 || =2.21.7 || =2.21.8 || =2.21.9 || =2.3.0 || =2.4.0 || =2.4.1 || =2.4.10 || =2.4.11 || =2.4.12 || =2.4.13 || =2.4.14 || =2.4.15 || =2.4.16 || =2.4.17 || =2.4.18 || =2.4.19 || =2.4.2 || =2.4.20 || =2.4.21 || =2.4.22 || =2.4.23 || =2.4.24 || =2.4.25 || =2.4.26 || =2.4.27 || =2.4.28 || =2.4.29 || =2.4.3 || =2.4.30 || =2.4.4 || =2.4.5 || =2.4.6 || =2.4.7 || =2.4.8 || =2.4.9 || =2.5.0 || =2.5.0-rc.0 || =2.5.0-rc.1 || =2.5.0-rc.2 || =2.5.0-rc.3 || =2.5.0-rc.4 || =2.5.0-rc.5 || =2.5.0-rc.6 || =2.5.1 || =2.5.10 || =2.5.11 || =2.5.12 || =2.5.13 || =2.5.14 || =2.5.15 || =2.5.16 || =2.5.2 || =2.5.3 || =2.5.4 || =2.5.5 || =2.5.6 || =2.5.7 || =2.5.8 || =2.5.9 || =2.6.0 || =2.6.1 || =2.6.10 || =2.6.11 || =2.6.13 || =2.6.14 || =2.6.15 || =2.6.16 || =2.6.17 || =2.6.18 || =2.6.19 || =2.6.2 || =2.6.20 || =2.6.21 || =2.6.22 || =2.6.23 || =2.6.24 || =2.6.25 || =2.6.26 || =2.6.27 || =2.6.28 || =2.6.29 || =2.6.3 || =2.6.30 || =2.6.31 || =2.6.4 || =2.6.5 || =2.6.6 || =2.6.7 || =2.6.8 || =2.6.9 || =2.7.0 || =2.7.1 || =2.8.0 || =2.8.1 || =2.9.0 || =2.9.1 || =2.9.10 || =2.9.11 || =2.9.12 || =2.9.13 || =2.9.14 || =2.9.15 || =2.9.16 || =2.9.17 || =2.9.18 || =2.9.19 || =2.9.2 || =2.9.20 || =2.9.21 || =2.9.22 || =2.9.23 || =2.9.24 || =2.9.25 || =2.9.26 || =2.9.27 || =2.9.28 || =2.9.29 || =2.9.3 || =2.9.4 || =2.9.5 || =2.9.6 || =2.9.7 || =2.9.8 || =2.9.9 || =3.0.0 || =3.0.0-rc.0 || =3.0.0-rc.1 || =3.0.0-rc.10 || =3.0.0-rc.11 || =3.0.0-rc.12 || =3.0.0-rc.13 || =3.0.0-rc.14 || =3.0.0-rc.15 || =3.0.0-rc.16 || =3.0.0-rc.17 || =3.0.0-rc.18 || =3.0.0-rc.19 || =3.0.0-rc.20 || =3.0.0-rc.21 || =3.0.0-rc.22 || =3.0.0-rc.23 || =3.0.0-rc.24 || =3.0.0-rc.25 || =3.0.0-rc.26 || =3.0.0-rc.27 || =3.0.0-rc.28 || =3.0.0-rc.29 || =3.0.0-rc.3 || =3.0.0-rc.31 || =3.0.0-rc.32 || =3.0.0-rc.33 || =3.0.0-rc.34 || =3.0.0-rc.35 || =3.0.0-rc.36 || =3.0.0-rc.37 || =3.0.0-rc.38 || =3.0.0-rc.39 || =3.0.0-rc.4 || =3.0.0-rc.40 || =3.0.0-rc.41 || =3.0.0-rc.42 || =3.0.0-rc.43 || =3.0.0-rc.44 || =3.0.0-rc.45 || =3.0.0-rc.46 || =3.0.0-rc.5 || =3.0.0-rc.6 || =3.0.0-rc.7 || =3.0.0-rc.8 || =3.0.0-rc.9 || =3.0.1 || =3.0.10 || =3.0.11 || =3.0.12 || =3.0.13 || =3.0.14 || =3.0.15 || =3.0.16 || =3.0.2 || =3.0.3 || =3.0.4 || =3.0.5 || =3.0.6 || =3.0.7 || =3.0.8 || =3.0.9 || =3.1.0 || =3.1.1 || =3.1.2 || =3.1.3 || =3.1.4 || =3.1.5 || =3.1.6 || =3.1.7 || =3.1.8 || =3.10.0 || =3.10.1 || =3.11.0 || =3.11.1 || =3.11.2 || =3.11.3 || =3.12.0 || =3.13.0 || =3.13.1 || =3.13.2 || =3.14.0 || =3.14.1 || =3.15.0 || =3.16.0 || =3.17.0 || =3.17.1 || =3.18.0 || =3.19.0 || =3.19.1 || =3.19.2 || =3.19.3 || =3.2.0 || =3.2.1 || =3.2.2 || =3.2.3 || =3.2.4 || =3.2.5 || =3.2.6 || =3.20.0 || =3.21.0 || =3.21.1 || =3.21.2 || =3.21.3 || =3.22.0 || =3.22.1 || =3.22.2 || =3.23.0 || =3.23.1 || =3.24.0 || =3.24.1 || =3.24.2 || =3.24.3 || =3.24.4 || =3.24.5 || =3.24.6 || =3.24.7 || =3.25.0 || =3.25.1 || =3.25.2 || =3.26.0 || =3.27.0 || =3.27.1 || =3.27.2 || =3.27.3 || =3.27.4 || =3.27.5 || =3.27.6 || =3.27.7 || =3.27.8 || =3.28.0 || =3.29.0 || =3.29.1 || =3.29.2 || =3.29.3 || =3.3.0 || =3.3.1 || =3.3.2 || =3.3.3 || =3.30.0 || =3.30.1 || =3.31.0 || =3.4.0 || =3.4.1 || =3.4.10 || =3.4.11 || =3.4.12 || =3.4.13 || =3.4.14 || =3.4.15 || =3.4.16 || =3.4.17 || =3.4.18 || =3.4.19 || =3.4.2 || =3.4.20 || =3.4.21 || =3.4.22 || =3.4.23 || =3.4.24 || =3.4.25 || =3.4.26 || =3.4.27 || =3.4.28 || =3.4.29 || =3.4.3 || =3.4.30 || =3.4.31 || =3.4.32 || =3.4.33 || =3.4.34 || =3.4.35 || =3.4.36 || =3.4.37 || =3.4.38 || =3.4.39 || =3.4.4 || =3.4.40 || =3.4.41 || =3.4.42 || =3.4.43 || =3.4.44 || =3.4.45 || =3.4.46 || =3.4.47 || =3.4.48 || =3.4.49 || =3.4.5 || =3.4.50 || =3.4.51 || =3.4.52 || =3.4.53 || =3.4.54 || =3.4.55 || =3.4.56 || =3.4.57 || =3.4.58 || =3.4.59 || =3.4.6 || =3.4.60 || =3.4.61 || =3.4.62 || =3.4.63 || =3.4.64 || =3.4.65 || =3.4.66 || =3.4.67 || =3.4.68 || =3.4.69 || =3.4.7 || =3.4.70 || =3.4.71 || =3.4.72 || =3.4.73 || =3.4.74 || =3.4.8 || =3.4.9 || =3.5.0 || =3.5.1 || =3.5.10 || =3.5.11 || =3.5.12 || =3.5.13 || =3.5.14 || =3.5.15 || =3.5.16 || =3.5.17 || =3.5.18 || =3.5.19 || =3.5.2 || =3.5.20 || =3.5.21 || =3.5.22 || =3.5.23 || =3.5.24 || =3.5.25 || =3.5.26 || =3.5.27 || =3.5.28 || =3.5.29 || =3.5.3 || =3.5.30 || =3.5.31 || =3.5.32 || =3.5.33 || =3.5.34 || =3.5.35 || =3.5.36 || =3.5.37 || =3.5.38 || =3.5.39 || =3.5.4 || =3.5.40 || =3.5.41 || =3.5.42 || =3.5.43 || =3.5.5 || =3.5.6 || =3.5.7 || =3.5.8 || =3.5.9 || =3.6.0 || =3.6.1 || =3.6.2 || =3.6.3 || =3.7.0 || =3.7.1 || =3.7.2 || =3.7.3 || =3.7.4 || =3.7.5 || =3.7.6 || =3.8.0 || =3.9.0 || >=1.52.0-rc.11 <3.31.1 | 3.31.1 |
