GitHub Advisoryadvisory · Hex

GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static

HIGH Published 2022-04-12 Modified 2022-04-12 Official page ↗
Aliases
CVE-2017-1000052
Ecosystem
Hex
Packages
plug
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-04-12

Affected packages

• Hex plug: < 1.0.4 → fixed in 1.0.4 • Hex plug: >= 1.1.0, < 1.1.7 → fixed in 1.1.7 • Hex plug: >= 1.2.0, < 1.2.3 → fixed in 1.2.3 • Hex plug: >= 1.3.0, < 1.3.2 → fixed in 1.3.2

Description

Plug.Static is used for serving static assets, and is vulnerable to null byte injection. If file upload functionality is provided, this can allow users to bypass filetype restrictions. We recommend all applications that provide file upload functionality and serve those uploaded files locally with Plug.Static to upgrade immediately or include the fix below. If uploaded files are rather stored and served from S3 or any other cloud storage, you are not affected.

Related

Alias · CVE (1)

  • CVE-2017-1000052 Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References