CyberRota Analysis
AI-GeneratedThe AshAuthentication module in the affected versions of the ash_authentication library is vulnerable to an inefficient algorithmic complexity issue, allowing unauthenticated attackers to exploit oversized base62 segments in API keys, leading to potential CPU and memory exhaustion. This vulnerability can cause service degradation or denial of service, making it critical for developers and organizations utilizing this library to prioritize patching to mitigate the risk of exploitation. Users of ash_authentication versions 4.8.0 to 4.15.0 and 5.0.0-rc.0 to 5.0.0-rc.14 should take immediate action to secure their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion. This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.