CVE-2019-16764 Information

Description

The use of String.to_atom/1 in PowAssent is susceptible to denial of service attacks. In PowAssent.Phoenix.AuthorizationController a value is fetched from the user provided params and String.to_atom/1 is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data and can be used to fill up the whole atom table of ~1M which will cause the app to crash.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

http://erlang.org/doc/efficiency_guide/commoncaveats.htmllist_to_atom-1 https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986 https://hex.pm/packages/pow_assent

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5