Phoenix vulnerabilities

A vulnerability in the Phoenix JavaScript presence client (Presence module) involves an improper existence check using a bare truthiness test (state[key]) instead of an own-property check. An attacker with ordinary channel access can choose a presence key that is an Object.prototype member name (e.g., __proto__, constructor, toString), causing the lookup to return the built-in prototype object and throw an uncaught TypeError. The flaw resides in assets/js/phoenix/presence.js in Presence.syncState and Presence.syncDiff and affects phoenix versions from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.

A vulnerability in the Phoenix.Socket module of the Phoenix framework allows an unauthenticated attacker to perform a DoS attack by sending a large number of phx_join messages over a single WebSocket or LongPoll connection. This exhausts the BEAM virtual machine process limit, blocking legitimate traffic across the entire node.

In the Phoenix (Elixir) long-poll transport, a POST request with Content-Type application/x-ndjson splits the request body on newline characters without limiting the number of segments. A body consisting entirely of newline bytes causes massive memory amplification and BEAM resource exhaustion, crashing the node and terminating sessions.