CVE-2017-1000052 Null Byte Injection in Plug.Static
Null byte injection in Plug.Static allows bypassing filetype restrictions, potentially exposing restricted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000052?
CVE-2017-1000052 is a high-severity vulnerability in n/a, published on 13 Jul 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
Weakness: CWE-74
Which versions are affected by CVE-2017-1000052?
8 open source packages ship an affected version, including plug. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plug Hex | All versions | 1.0.4 |
plug Hex | All versions | 1.0.4 |
plug Hex | From 1.1.0 | 1.1.7 |
plug Hex | From 1.1.0 | 1.1.7 |
plug Hex | From 1.2.0 | 1.2.3 |
plug Hex | From 1.2.0 | 1.2.3 |
2 more packages
plug Hex | From 1.3.0 | 1.3.2 |
plug Hex | From 1.3.0 | 1.3.2 |
Products include Plug Project Plug.
How do I fix CVE-2017-1000052?
Upgrade plug to a fixed version for your release line: 1.0.4, 1.1.7, 1.2.3 or 1.3.2.
Is CVE-2017-1000052 being exploited?
There is no known exploitation of CVE-2017-1000052 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2q6v-32mr-8p8x.