Executive brief
Ash is a framework used to build data-driven applications with built-in validation controls. A validation component designed to confirm sensitive fields (like password changes) inadvertently echoes back the actual stored value when an attacker deliberately submits an incorrect confirmation, allowing them to read sensitive data without proper authorization. This bypasses the intended security of confirmation fields that should remain private.
Technical details
The vulnerability is an information disclosure (CWE-209: Information Exposure Through an Error Message) in the Ash.Resource.Validation.Confirm validator's atomic implementation. When an actor supplies only the confirmation argument and omits the field itself, the atomic_ref/2 function resolves the error's value parameter to the field's current stored value rather than the actor-supplied input. An attacker can exploit this by intentionally providing a wrong confirmation value and extracting the real stored value from the mismatch error message. The fix changes error reporting to use the actor-supplied confirmation value instead of the stored field value, preventing data leakage. Network reachability and valid credentials to submit forms are required; no special privileges are needed.
Affected products
- ash-project ash 2.17.20 to before 3.32.2
Timeline
- 2026-09-01: disclosed