Executive brief
AshAdmin, a web framework for building admin interfaces, shipped with a hardcoded, publicly known security token (nonce) used to protect against malicious script injection. This token was never changed on a per-request basis, allowing an attacker who can inject HTML on an admin page to bypass the Content Security Policy and execute arbitrary JavaScript with admin privileges.
Technical details
This vulnerability stems from use of insufficiently random values in Content Security Policy (CSP) nonce generation. AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to a compile-time constant literal value "ash_admin-Ed55GFnX" when the :csp_nonce_assign_key option was not configured. This hardcoded nonce was written verbatim into the nonce attribute of inline <style> and <script> tags on every response. The nonce value is published in the repository and never rotates per request. An attacker exploiting an HTML-injection vulnerability on an admin page could reuse the known nonce to execute inline scripts that the CSP policy was intended to block. The vulnerability affects ash_admin versions 0.10.8 through 1.3.0; version 1.3.1 and later generate fresh random nonces per request.
Affected products
- ash-project ash_admin 0.10.8 to 1.3.0
Timeline
- 2026-08-31: disclosed