Email Link Auto-Click Account Confirmation Vulnerability in ash_authentication

Background

ash_authentication is an open-source package used for managing user authentication in Elixir applications. It provides features such as user registration, login, and account confirmation. However, it has a vulnerability in its account confirmation flow, which can be exploited by attackers to confirm accounts using another user's email without their consent.

Vulnerability Detail

The vulnerability arises from the confirmation flow for account creation, which utilizes a GET request triggered by clicking a link sent via email. Some email clients and security tools may automatically follow these links, leading to unintended account confirmation. This allows attackers to register accounts using victims' email addresses, potentially resulting in unauthorized account confirmations. It is important to note that this vulnerability does not allow attackers to access existing accounts or private data, as it is limited to the confirmation of new accounts only.

Workaround

If upgrading is not feasible, users can disable the confirmation routes and create a custom LiveView. This LiveView should perform a POST request to the old confirmation URL instead of a GET request. The token should be passed as a hidden field in a form with a button that submits the form. Here is an example of how to implement this:

<form phx-submit="confirm">
  <input type="hidden" name="token" value="<token_value>" />
  <button type="submit">Confirm Account</button>
</form>

Conclusion

The ash_authentication package has a vulnerability that can lead to unintended account confirmations via email link auto-clicking. Users are strongly advised to upgrade to the latest versions to mitigate this risk. Workarounds are available, but upgrading is the recommended approach.

See every vulnerability recorded for ash_authentication →

FAQ