GHSA-55gf-3263-4r39: AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
Summary
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.
The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ashauthentication.install writes signinwithpassword, requestpasswordresettoken and requestmagiclink, mix ashauthentication.upgrade then adds bruteforcestrategy to those strategies, and mix ashauthentication.addstrategy.otp writes its OTP actions without the preparation. Separately, with registrationenabled? true the OTP sign-in is a create action, which preparations do not run on, so bruteforcestrategy {:preparation, module} never applied to it.
This issue affects ashauthentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
Workarounds
Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For bruteforcestrategy {:auditlog, name} that is prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, actionname: <action>} on the password sign-in, password reset request, magic link request and OTP request actions, and prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, actionname: <action>} on a read OTP sign-in action. For {:preparation, MyModule} it is prepare MyModule. For OTP with registrationenabled? true, switch to bruteforcestrategy :ratelimit.
Configurations
A password, magic link or OTP strategy sets bruteforcestrategy and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets registrationenabled? true with bruteforcestrategy {:preparation, module}. Actions the strategies generate themselves, and the OTP strategy's :ratelimit mode, are not affected.
Other sources
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.
The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ashauthentication.install writes signinwithpassword, requestpasswordresettoken and requestmagiclink, mix ashauthentication.upgrade then adds bruteforcestrategy to those strategies, and mix ashauthentication.addstrategy.otp writes its OTP actions without the preparation. Separately, with registrationenabled? true the OTP sign-in is a create action, which preparations do not run on, so bruteforcestrategy {:preparation, module} never applied to it.
This issue affects ashauthentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.16 - Configuration
For brute_force_strategy {:audit_log, name}, add prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: <action>} to password sign-in, password reset request, magic link request, and OTP request actions; add prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: <action>} to a read OTP sign-in action. For brute_force_strategy {:preparation, MyModule}, add prepare MyModule.
AshAuthentication resource protected actions brute-force preparation = Add the matching preparation to each resource-defined protected action, or omit the action so the strategy generates it - Configuration
When registration_enabled? is true and the OTP sign-in is a create action, switch from brute_force_strategy {:preparation, module} to brute_force_strategy :rate_limit so brute-force limiting is applied.
AshAuthentication OTP strategy brute_force_strategy = :rate_limit
Event History
Frequently Asked Questions
Which installations are affected?
Ash Authentication versions from 5.0.0-rc.4 before 5.0.0-rc.16 are affected when protected sign-in or request actions are defined on the resource without the brute-force preparation. This includes actions generated by the install, upgrade, and OTP strategy tasks described in the advisory.
Does a generated configuration require manual review?
Yes. `mix ash_authentication.install` generates password sign-in, password-reset-token request, and magic-link request actions, while later upgrade steps add `brute_force_strategy` to the strategies without ensuring those existing actions carry the required preparation. The OTP strategy generator also writes OTP actions without that preparation.
What does an attacker need to exploit the issue?
An attacker does not need authentication or user interaction. They can repeatedly guess passwords or one-time passwords when the applicable action has no enforced brute-force limit.
What can be done before upgrading?
Add the brute-force preparation to each protected action. However, when `registration_enabled? true`, OTP sign-in is a create action and preparations do not run on it, so a `brute_force_strategy {:preparation, module}` setting does not protect that OTP sign-in action.
How can I tell whether my application is exposed?
Check whether you use an affected Ash Authentication release and inspect resource-defined password, magic-link, password-reset, and OTP actions for the brute-force preparation. In particular, review actions generated by the install, upgrade, or OTP strategy commands, and OTP sign-in configured as a create action with registration enabled.