Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated patch commit 6ee03f1c738d4436dde1b066cf65c80663d489f5 clearly identifies the root cause of the vulnerability. The vulnerability existed in the PhoenixStorybook.Story.ComponentIframeLive LiveView, specifically within the handle_params/3 callback function. This function is invoked when the LiveView is mounted or updated with new parameters from the URL.
The original code unsafely trusted the topic query parameter. An attacker could initiate a GET request to the storybook iframe URL (/storybook/iframe/<story>) and append ?topic=<victim_topic>. The handle_params function would then read this malicious topic and broadcast the attacker's iframe PID onto the victim's private topic. The victim's playground, subscribed to this topic, would then start sending its private control messages to the attacker's iframe, leading to information disclosure.
The patch rectifies this by removing the reliance on the user-provided topic parameter. Instead, it introduces a playground_token, which is a signed token generated on the server side (StoryLive module). This token securely carries the topic information. The ComponentIframeLive module now receives this token, verifies its signature using Phoenix.Token.verify, and only then extracts and uses the topic. This ensures that the iframe can only connect to a playground topic that was legitimately assigned to it by the server, preventing the cross-session hijacking.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phoenix_storybook | erlang | >= 0.4.0, < 1.1.0 | 1.1.0 |
