PT-2017-10762 · Elixir · Elixir Plug

Published 2017-07-13 · Updated 2022-04-12 · CVE-2017-1000052

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elixir Plug versions prior to 1.0.4 Elixir Plug versions prior to 1.1.7 Elixir Plug versions prior to 1.2.3 Elixir Plug versions prior to 1.3.2

Description The issue concerns null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions. Plug.Static is used for serving static assets. If file upload functionality is provided, this can allow users to bypass filetype restrictions.

Recommendations For versions prior to 1.0.4, upgrade to version 1.0.4 or later. For versions prior to 1.1.7, upgrade to version 1.1.7 or later. For versions prior to 1.2.3, upgrade to version 1.2.3 or later. For versions prior to 1.3.2, upgrade to version 1.3.2 or later. As a temporary workaround, consider restricting the use of the Plug.Static component for serving uploaded files locally until a patch is available. If uploaded files are stored and served from cloud storage like S3, no immediate action is required.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-1000052

GHSA-2Q6V-32MR-8P8X

Affected Products

Elixir Plug

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000052 · Security Note
• https://osv.dev/vulnerability/GHSA-2q6v-32mr-8p8x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000052 · Vendor Advisory
• https://github.com/elixir-plug/plug · Note
• https://elixirforum.com/t/security-releases-for-plug/3913 · Note