GHSA-PCXQ-FJP3-R752

Vulnerability from github – Published: 2025-10-17 18:03 – Updated: 2025-10-17 20:07
VLAI?
Summary
Ash has authorization bypass when bypass policy condition evaluates to true
Details

Summary

Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.

Impact

Resources with bypass policies can be accessed without proper authorization when: - Bypass condition evaluates to true - Bypass authorization checks fail - Other policies exist but their conditions don't match

Details

Vulnerable code in: lib/ash/policy/policy.ex:69

{%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} ->
  {
    b(cond_expr or one_condition_matches),  # <- Bug: uses condition only
    b(complete_expr or all_policies_match)
  }

The final authorization decision is: one_condition_matches AND all_policies_match

When a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:

  1. one_condition_matches = cond_expr (bypass condition) = true (bug - should check if bypass actually authorizes)
  2. all_policies_match = (complete_expr OR NOT cond_expr) for each policy
  3. For non-matching policies: (false OR NOT false) = true (policies don't apply)
  4. Final: true AND true = true (incorrectly authorized)

The bypass condition alone satisfies "at least one policy applies" even though the bypass fails to authorize.

Fix

Replace cond_expr with complete_expr on line 69:

{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, all_policies_match} ->
  {
    b(complete_expr or one_condition_matches),  # <- Fixed
    b(complete_expr or all_policies_match)
  }

Line 52 should also be updated for consistency (though it's only triggered when bypass is the last policy, making it coincidentally safe in practice):

{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, true} ->
  {
    b(complete_expr or one_condition_matches),  # <- For consistency
    complete_expr
  }

PoC

policies do
  bypass always() do
    authorize_if actor_attribute_equals(:is_admin, true)
  end

  policy action_type(:read) do
    authorize_if always()
  end
end

Non-admin user can perform create actions (should be denied).

Test demonstrating the bug:

test "bypass policy bug" do
  policies = [
    %Ash.Policy.Policy{
      bypass?: true,
      condition: [{Ash.Policy.Check.Static, result: true}],  # condition = true
      policies: [
        %Ash.Policy.Check{
          type: :authorize_if,
          check: {Ash.Policy.Check.Static, result: false},  # policies = false
          check_module: Ash.Policy.Check.Static,
          check_opts: [result: false]
        }
      ]
    },
    %Ash.Policy.Policy{
      bypass?: false,
      condition: [{Ash.Policy.Check.Static, result: false}],
      policies: [
        %Ash.Policy.Check{
          type: :authorize_if,
          check: {Ash.Policy.Check.Static, result: true},
          check_module: Ash.Policy.Check.Static,
          check_opts: [result: true]
        }
      ]
    }
  ]

  expression = Ash.Policy.Policy.expression(policies, %{})

  assert expression == false
  # Expected: false (deny)
  # Actual on main: true (incorrectly authorized)
end
Severity ?
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.0"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "ash"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.3"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-17T18:03:06Z",
    "nvd_published_at": "2025-10-17T14:15:46Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nBypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.\n\n### Impact\nResources with bypass policies can be accessed without proper authorization when:\n- Bypass condition evaluates to true\n- Bypass authorization checks fail\n- Other policies exist but their conditions don\u0027t match\n\n### Details\nVulnerable code in: [lib/ash/policy/policy.ex:69](https://github.com/ash-project/ash/blob/b2e4d625/lib/ash/policy/policy.ex#L69)\n\n```elixir\n{%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} -\u003e\n  {\n    b(cond_expr or one_condition_matches),  # \u003c- Bug: uses condition only\n    b(complete_expr or all_policies_match)\n  }\n```\n\nThe final authorization decision is: `one_condition_matches AND all_policies_match`\n\nWhen a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:\n\n1. **one_condition_matches** = `cond_expr` (bypass condition) = **true** (bug - should check if bypass actually authorizes)\n2. **all_policies_match** = `(complete_expr OR NOT cond_expr)` for each policy\n   - For non-matching policies: `(false OR NOT false)` = **true** (policies don\u0027t apply)\n3. **Final**: `true AND true` = **true** (incorrectly authorized)\n\nThe bypass condition alone satisfies \"at least one policy applies\" even though the bypass fails to authorize.\n\n### Fix\nReplace `cond_expr` with `complete_expr` on line 69:\n```elixir\n{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, all_policies_match} -\u003e\n  {\n    b(complete_expr or one_condition_matches),  # \u003c- Fixed\n    b(complete_expr or all_policies_match)\n  }\n```\n\nLine 52 should also be updated for consistency (though it\u0027s only triggered when bypass is the last policy, making it coincidentally safe in practice):\n```elixir\n{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, true} -\u003e\n  {\n    b(complete_expr or one_condition_matches),  # \u003c- For consistency\n    complete_expr\n  }\n```\n\n### PoC\n```elixir\npolicies do\n  bypass always() do\n    authorize_if actor_attribute_equals(:is_admin, true)\n  end\n\n  policy action_type(:read) do\n    authorize_if always()\n  end\nend\n```\n\nNon-admin user can perform create actions (should be denied).\n\nTest demonstrating the bug:\n```elixir\ntest \"bypass policy bug\" do\n  policies = [\n    %Ash.Policy.Policy{\n      bypass?: true,\n      condition: [{Ash.Policy.Check.Static, result: true}],  # condition = true\n      policies: [\n        %Ash.Policy.Check{\n          type: :authorize_if,\n          check: {Ash.Policy.Check.Static, result: false},  # policies = false\n          check_module: Ash.Policy.Check.Static,\n          check_opts: [result: false]\n        }\n      ]\n    },\n    %Ash.Policy.Policy{\n      bypass?: false,\n      condition: [{Ash.Policy.Check.Static, result: false}],\n      policies: [\n        %Ash.Policy.Check{\n          type: :authorize_if,\n          check: {Ash.Policy.Check.Static, result: true},\n          check_module: Ash.Policy.Check.Static,\n          check_opts: [result: true]\n        }\n      ]\n    }\n  ]\n\n  expression = Ash.Policy.Policy.expression(policies, %{})\n  \n  assert expression == false\n  # Expected: false (deny)\n  # Actual on main: true (incorrectly authorized)\nend\n```",
  "id": "GHSA-pcxq-fjp3-r752",
  "modified": "2025-10-17T20:07:12Z",
  "published": "2025-10-17T18:03:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48044"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ash-project/ash"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ash has authorization bypass when bypass policy condition evaluates to true"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.