Plausible Analytics Pre-Authentication RCE via Phoenix Story...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://whoareme.com/blog/plausible-analytics-multiple-criticals
• Blog Title: Plausible Analytics: Pre-Authentication RCE via Phoenix Storybook (CVE-2026-8467)
• Suggested Section: Pentesting Web -> SSTI / Server-Side Template Injection, with a new Phoenix LiveView and HEEx/EEx expression-injection subsection; optionally cross-reference Network Services Pentesting -> Pentesting Web -> Phoenix/Elixir developer interfaces

🎯 Content Summary

CVE-2026-8467: Unauthenticated RCE through Phoenix Storybook

The post documents CVE-2026-8467, a critical unauthenticated HEEx/Elixir code-injection vulnerability in phoenix_storybook. Plausible Analytics Community Edition versions v3.0.0 through v3.2.0 expose the vulnerable Storybook functionality; Plausible CE v3.2.1 fixes the issue. The reviewed dependency source corresponds...

🔧 Technical Details

Auditing unauthenticated LiveView and development interfaces: Enumerate LiveView routes, WebSocket endpoints, component explorers, Storybook instances, playgrounds, debugging pages, and other developer tooling exposed without authentication. Capture /live/websocket traffic and trace each event from handle_event/3 through conversion helpers and renderers to high-risk sinks such as template compilers, dynamic evaluators, deserializers, or process-execution functions. In this case the exploitable chain was psb-assign → handle_set_variation_assign/3 → to_value/4 → attributes_markup/1 → EEx.compile_string/2 → Code.eval_quoted_with_env/3.

Generated-template quote breakout: Construction such as ~s|#{name}="#{val}"| is unsafe when val is untrusted and the resulting string is subsequently compiled as HEEx. A payload sha...

🤖 Agent Actions

Updated src/pentesting-web/ssti-server-side-template-injection/README.md.

Added a cited Elixir / Phoenix LiveView HEEx expression injection section covering:

• LiveView developer-interface enumeration and event tracing
• HEEx attribute quote breakout
• Compiler-error oracle and System.cmd/2 RCE
• Phoenix channel event replay structure
• Data-as-assigns remediation and safe atom handling

Technical details were verified against the PhoenixStorybook advisory and original research post.

Validation passed: clean diff, sequential references, balanced code fences, and valid JSON example. Full mdBook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://whoareme.com/blog/plausible-analytics-multiple-criticals

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> SSTI / Server-Side Template Injection, with a new Phoenix LiveView and HEEx/EEx expression-injection subsection; optionally cross-reference Network Services Pentesting -> Pentesting Web -> Phoenix/Elixir developer interfaces".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0