CyberRota Analysis
AI-GeneratedThe vulnerability allows an Ash.Reactor change step to be bypassed when a validation guard raises an exception, leading to potential security-relevant modifications being skipped instead of failing securely. This flaw could be exploited through attacker-influenced input, resulting in unintended behavior in applications using the affected versions of the ash framework. Developers and security teams utilizing ash versions from 3.0.0-rc.17 to before 3.32.2 should prioritize applying the fix to ensure proper enforcement of security measures.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed. This issue affects ash: from 3.0.0-rc.17 before 3.32.2.