PT-2017-10762 · Elixir · Elixir Plug

Publicado 2017-07-13 · Atualizado 2022-04-12 · CVE-2017-1000052

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elixir Plug versions prior to 1.0.4 Elixir Plug versions prior to 1.1.7 Elixir Plug versions prior to 1.2.3 Elixir Plug versions prior to 1.3.2

Description The issue concerns null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions. Plug.Static is used for serving static assets. If file upload functionality is provided, this can allow users to bypass filetype restrictions.

Recommendations For versions prior to 1.0.4, upgrade to version 1.0.4 or later. For versions prior to 1.1.7, upgrade to version 1.1.7 or later. For versions prior to 1.2.3, upgrade to version 1.2.3 or later. For versions prior to 1.3.2, upgrade to version 1.3.2 or later. As a temporary workaround, consider restricting the use of the Plug.Static component for serving uploaded files locally until a patch is available. If uploaded files are stored and served from cloud storage like S3, no immediate action is required.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-1000052

GHSA-2Q6V-32MR-8P8X

Produtos afetados

Elixir Plug

Referências · 5

• https://github.com/elixir-plug/plug · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000052 · Nota de Segurança
• https://elixirforum.com/t/security-releases-for-plug/3913 · Nota
• https://osv.dev/vulnerability/GHSA-2q6v-32mr-8p8x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000052 · Aviso do Fabricante