【中危】oban_web 安全更新（GHSA-6xh2-93p9-vqh4）

安全情报快照 · 风险级别：中危 · CVE-2026-48593 · GHSA-6xh2-93p9-vqh4

先看结论

oban_web存在安全风险，>= 2.12.0, < 2.12.5 受影响，建议升级至 2.12.5。

影响范围

生态	组件	受影响版本	首个修复版本
erlang	`oban_web`	>= 2.12.0, < 2.12.5	2.12.5

处置建议

优先将 oban_web 升级至 2.12.5 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

oban_web 2.12.0 introduced a cron expression parser that expands --separated ranges without validating the endpoints. An attacker with access to schedule cron jobs can submit a malicious expression; when any user with dashboard access views the cron job list, Oban.Web.CronExpr.describe/1 is called to render it, triggering allocation of gigabytes of memory and stalling or crashing the BEAM node.

Details

1. Scheduling: The attacker submits a cron job with a malicious expression such as "0 0 1-100000000 * *". No special privilege is required beyond the ability to schedule cron jobs.

2. Parsing: When the cron list is rendered in the dashboard, describe/1 calls parse_range/1 in lib/oban/web/cron_expr.ex, which calls Integer.parse/1 on both endpoints of the range with no bounds check, returning {:range, start_val, end_val} for any integers.

3. Eager expansion: expand_dom_parts/1 and expand_dow_parts/1 materialise the range via Enum.to_list(start_val..end_val). The input above produces ~100 million integers (~2.4 GB). A sibling helper extract_dom_values already validates range bounds, but the expansion helpers do not.

PoC

Schedule a cron job with expression "0 0 1-100000000 * *" (or any expression with an out-of-domain range).
Have any user with Oban.Web dashboard access navigate to the cron job list.
The dashboard calls describe/1 to render the expression, exhausting BEAM memory and crashing the node.

Impact

CVSS 4.0 score 5.9 (Medium). Affects oban_web >= 2.12.0. Requires the ability to schedule a cron job and a dashboard user to view the cron list; no further privileges are needed.

References

Introduction commit: https://github.com/oban-bg/oban_web/commit/a97c7960bb389b05aaab4cf8042985f02ceddc24
Patch commit: https://github.com/oban-bg/oban_web/commit/9998b7e284e02fdd4645dd6231760038e63b584d

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。