Null Byte Injection in Plug.Static
High severity
GitHub Reviewed
Published
Apr 12, 2022
to the GitHub Advisory Database
•
Updated Jan 11, 2023
Package
Affected versions
< 1.0.4
>= 1.1.0, < 1.1.7
>= 1.2.0, < 1.2.3
>= 1.3.0, < 1.3.2
Patched versions
1.0.4
1.1.7
1.2.3
1.3.2
Description
Published to the GitHub Advisory Database
Apr 12, 2022
Reviewed
Apr 12, 2022
Last updated
Jan 11, 2023
Plug.Static is used for serving static assets, and is vulnerable to null
byte injection. If file upload functionality is provided, this can allow
users to bypass filetype restrictions.
We recommend all applications that provide file upload functionality and
serve those uploaded files locally with Plug.Static to upgrade immediately
or include the fix below. If uploaded files are rather stored and served
from S3 or any other cloud storage, you are not affected.
References