nerves_hub_web vulnerabilities

An Improper Authentication vulnerability in Google sign-in and email confirmation in nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. The system signs a Google user into any account with the same email without the owner proving ownership.

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The role is read once when a page mounts and membership is checked once at channel join, so changes are not propagated. The dashboard also opens consoles with a token valid for 24 hours that is not revoked by signing out.

An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms, and JITP settings in nerves_hub_web allows an authenticated user who manages devices in one organization to write into other organizations via submitted org_id, product_id, and deployment_id fields. A device placed on another organization's deployment group is sent that organization's firmware with a download URL.

An Incorrect Authorization vulnerability in the devices page bulk move in nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product. A moved device keeps its key and certificate and joins the target organization's deployment groups.

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers carry out changes without calling authorized!/2, and the pages render the controls to every member. A view member can add or delete certificates, change tags, manual location, deployment group membership, and start, retry or delete firmware delta builds.

A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.