PT-2017-10763 · Elixir · Elixir Plug

Published 2017-07-13 · Updated 2022-04-12 · CVE-2017-1000053

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elixir Plug versions prior to 1.0.4 Elixir Plug versions prior to 1.1.7 Elixir Plug versions prior to 1.2.3 Elixir Plug versions prior to 1.3.2

Description The issue concerns arbitrary code execution in the deserialization functions of Plug.Session. The default serialization used by Plug session may result in code execution in certain situations. However, this can only be exploited if the attacker has access to the secret key as well as the signing/encryption salts.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later. For versions prior to 1.1.7, update to version 1.1.7 or later. For versions prior to 1.2.3, update to version 1.2.3 or later. For versions prior to 1.3.2, update to version 1.3.2 or later. As a general precaution, consider changing the secret key base and salts if they are suspected to have been leaked.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-1000053

GHSA-5V4M-C73V-C7GQ

Affected Products

Elixir Plug

References · 5

• https://osv.dev/vulnerability/CVE-2017-1000053 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5v4m-c73v-c7gq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000053 · Security Note
• https://github.com/elixir-plug/plug · Note
• https://elixirforum.com/t/security-releases-for-plug/3913 · Note