Authorization Flaw in ash (CVE-2025-48044)
Summary
Vulnerability in ash (CVE-2025-48044). Confidential information can be exposed externally. Exploitable via cond_expr. Mitigation: upgrade to 3.7.1 or later.
Original description
The description as published by the source.
Summary
Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.
Impact
Resources with bypass policies can be accessed without proper authorization when:
- Bypass condition evaluates to true
- Bypass authorization checks fail
- Other policies exist but their conditions don't match
Details
Vulnerable code in: lib/ash/policy/policy.ex:69
{%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} ->
{
b(cond_expr or one_condition_matches), # <- Bug: uses condition only
b(complete_expr or all_policies_match)
}
The final authorization decision is: one_condition_matches AND all_policies_match
When a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:
- one_condition_matches =
cond_expr(bypass condition) = true (bug - should check if bypass actually authorizes) - all_policies_match =
(complete_expr OR NOT cond_expr)for each policy- For non-matching policies:
(false OR NOT false)= true (policies don't apply)
- For non-matching policies:
- Final:
true AND true= true (incorrectly authorized)
The bypass condition alone satisfies "at least one policy applies" even though the bypass fails to authorize.
Fix
Replace cond_expr with complete_expr on line 69:
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2025-48044 has been found in ash.
Attackers can target a specific entry point like cond_expr over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade ash to 3.7.1 or later.
If unsure, ask your IT team or search "ash CVE-2025-48044" on the vendor's site.
CVE-2025-48044 (ash) — CWE-863
Attack vector: remote (network-reachable) / no user interaction
Attack surface: cond_expr / complete_expr
Patched: 3.7.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Incorrect authorization (CWE-863) exists in ash. Attackers reach the vulnerable code path via cond_expr.
Check the vendor advisory for the affected versions of ash. Attack surface: cond_expr / complete_expr.
Severity: ?. Confidential information can be exposed externally.
Update to 3.7.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'ash' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'ash' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
ashを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade ash to 3.7.1ステージング環境で 3.7.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package hex.pm
- package github.com
- web github.com
- web cna.erlef.org
- web github.com
- web osv.dev
- web github.com