CyberRota Analysis
AI-GeneratedThe ash_sqlite library is vulnerable to improper neutralization of special elements in data query logic, allowing attackers to manipulate the JSON path in a way that exposes sensitive embedded fields not intended for disclosure. This vulnerability primarily affects any application endpoint that permits user input to reach the get_path segment, potentially leading to unauthorized access to private data. Organizations utilizing ash_sqlite versions from 0.1.2-rc.0 to before 0.2.18 should prioritize remediation to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.