Executive brief
ash_phoenix is a web framework used to build multi-tenant applications that use subdomain-based tenant separation. A vulnerability in the subdomain extraction logic allows remote attackers to bypass tenant isolation and switch between tenants, or degrade application functionality, by sending a crafted Host header.
Technical details
The vulnerability exists in the AshPhoenix.Helpers.get_subdomain/2 function, which uses String.replace with an unanchored, global regular expression to strip the root domain from the Host header. The root_host parameter is interpolated raw into the regex pattern without escaping, allowing metacharacters like . to be interpreted as wildcards. This permits attackers to craft malicious Host headers (e.g., "foo.exampleXcom.attacker.net" to extract "foo.attacker.net" instead of "foo") to select arbitrary tenants. Additionally, the comparison is case-sensitive, allowing bypass of tenant allowlists with uppercase variants. The attack requires only a network-accessible application and no authentication. The fix matches the root host case-insensitively and only as an exact trailing suffix.
Affected products
- ash-project ash_phoenix 2.1.26 to before 2.3.25
Timeline
- 2026-08-31: published