A critical vulnerability in ash-project ash_lua allows unauthenticated attackers to bypass field access controls and exfiltrate sensitive data.

The vulnerability exists in the AshLua runtime, where the read action aggregate path fails to enforce the configured exposed-field allow-list. By supplying a crafted Lua script, an unauthenticated attacker can query and read sensitive resource attributes, such as hashed passwords, effectively turning the system into a data oracle.

The ability to access sensitive, non-public attributes poses a severe risk to data confidentiality and regulatory compliance. Given the CVSS score of 8.2, this high-severity flaw could lead to the exposure of user credentials or proprietary business data. Unauthorized access to sensitive columns within the application database may result in significant reputational damage and potential legal liabilities.

Immediate Action: Update the ash_lua dependency to version 0.2.1 or later to implement the necessary field allow-list enforcement.

Proactive Monitoring: Review application logs for unusual Lua script execution patterns or unexpected database aggregate queries that target sensitive resource attributes.

Compensating Controls: If an immediate update is not possible, restrict the ability of users or external inputs to submit or influence Lua scripts within the application environment.

Public Exploit Available: No

The vulnerability represents a significant security oversight in the handling of data access controls within the ash_lua component. IT administrators must prioritize updating to version 0.2.1 immediately to close the path for unauthorized data exfiltration. Failure to patch this issue leaves sensitive resource attributes exposed to any party capable of influencing script execution within the environment.