PT-2017-10910 · Elixir · Alchemist.Vim

Ivan · Published 2017-11-17 · Updated 2022-05-13 · CVE-2017-1000212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions alchemist.vim (affected versions not specified)

Description The issue concerns remote code execution in the alchemist-server bundled with Elixir's vim plugin, alchemist.vim. A malicious website can execute requests against an ephemeral port on localhost, which are then evaluated as Elixir code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-1000212

GHSA-6X65-VQP7-5R63

Affected Products

Alchemist.Vim

References · 6

• https://osv.dev/vulnerability/GHSA-6x65-vqp7-5r63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000212 · Security Note
• https://github.com/tonini/alchemist-server/issues/14 · Note
• https://github.com/tonini/alchemist-server · Note
• https://github.com/tonini/alchemist-server/pull/16 · Note
• https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913 · Note