Executive Summary

This vulnerability is a Missing Authorization issue in the oban_web component of oban-bg, specifically in the 'Elixir.Oban.Web.Jobs.DetailComponent' modules.

The problem occurs because the handler for the "save-job" event does not perform an authorization check, unlike other handlers such as cancel, delete, and retry which verify user privileges.

As a result, an authenticated user with only read-only access can send a forged "save-job" event via LiveView WebSocket to change a job's worker field to any other existing worker module in the application.

When the job runs next, it will execute the attacker-chosen worker module instead of the intended one, potentially allowing unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited access (read-only) to substitute the worker module of a job with a different one.

This means the attacker can cause the system to execute arbitrary or unintended code during job processing, potentially leading to unauthorized actions or data manipulation.

Such unauthorized job worker substitution could compromise the integrity and expected behavior of background jobs, possibly leading to security breaches or system misuse.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user with read-only access to perform unauthorized job worker substitution by exploiting a missing authorization check. This could potentially lead to unauthorized actions within the application.

However, there is no specific information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0