GitHub Advisoryadvisory · Hex
GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization
HIGH
Official page ↗
- Aliases
- CVE-2017-1000053
- Ecosystem
- Hex
- Packages
- plug
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2022-04-12
Affected packages
• Hex plug: < 1.0.4 → fixed in 1.0.4
• Hex plug: >= 1.1.0, < 1.1.7 → fixed in 1.1.7
• Hex plug: >= 1.2.0, < 1.2.3 → fixed in 1.2.3
• Hex plug: >= 1.3.0, < 1.3.2 → fixed in 1.3.2
Description
The default serialization used by Plug session may result in code execution
in certain situations. Keep in mind, however, the session cookie is signed
and this attack can only be exploited if the attacker has access to your
secret key as well as your signing/encryption salts. We recommend users to
change their secret key base and salts if they suspect they have been leaked,
regardless of this vulnerability.
Related
Alias · CVE (1)
- CVE-2017-1000053 Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness