GHSA-389x-rgxr-8m33
Fix: oban-bg/oban_web@ab3c5d1GHSA-389x-rgxr-8m33 is a CWE-862 vulnerability in oban_web. O3 Security confirms whether GHSA-389x-rgxr-8m33 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
oban_web missing authorization check on `save-job` event handler
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-389x-rgxr-8m33.
Real-World Exposure
oban_webReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Hex packages — download data is not available via public APIs for these ecosystems.
Description
Summary
oban_web 2.12.0 through the current unpatched release exposes a save-job LiveView event handler that performs no authorization check, allowing any authenticated user (including those with :read_only access) to overwrite a queued job's worker field with any other Oban.Worker module present in the application. On the job's next execution attempt, Oban dispatches perform/1 on the attacker-chosen module instead of the intended one.
Details
In lib/oban/web/live/jobs/detail_component.ex, the sibling event handlers for destructive actions all gate their side effects via can?/2 (cancel, delete, retry). The handle_event("save-job", params, socket) clause added in 2.12.0 has no equivalent guard. It builds a changes map from the client-supplied params (including worker, queue, priority, max_attempts, scheduled_at, tags, args) and unconditionally dispatches {:update_job, job, changes} to the parent LiveView, which writes the changes to the database.
The disabled attribute on the edit fieldset and button in the rendered HTML is advisory only. The Phoenix LiveView channel dispatches any phx-event pushed over the authenticated WebSocket regardless of what the DOM looks like, so the attacker pushes the event directly over the WebSocket without touching the UI.
The attacker is constrained to substituting an existing Oban.Worker module already loaded in the application (no code injection). The impact depends on what workers are available in the target application.
PoC
- Obtain an authenticated session with at minimum
:read_onlyaccess to the Oban.Web dashboard. - Open any job's detail panel to obtain its job ID.
- Push a forged
save-jobevent over the LiveView WebSocket with"worker"set to the desired target module name. - The server accepts the payload and updates the job row. On its next execution attempt, Oban invokes
perform/1on the attacker-chosen module.
Impact
CVSS 4.0 score 5.3 (Medium). Any application running oban_web >= 2.12.0 that exposes the dashboard to users with less than full job-management privileges is affected. The only precondition is an authenticated session with :read_only access or higher.
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💧Hex | oban_web | ≥ 2.12.0&&< 2.12.5 | 2.12.5 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for oban_web. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update oban_web to 2.12.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-389x-rgxr-8m33 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-389x-rgxr-8m33 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-389x-rgxr-8m33. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-389x-rgxr-8m33 in your dependencies?
O3 detects GHSA-389x-rgxr-8m33 across Hex dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.