Arbitrary Code Execution in Cookie Serialization
High severity
GitHub Reviewed
Published
Apr 12, 2022
to the GitHub Advisory Database
•
Updated Jan 11, 2023
Package
Affected versions
< 1.0.4
>= 1.1.0, < 1.1.7
>= 1.2.0, < 1.2.3
>= 1.3.0, < 1.3.2
Patched versions
1.0.4
1.1.7
1.2.3
1.3.2
Description
Published to the GitHub Advisory Database
Apr 12, 2022
Reviewed
Apr 12, 2022
Last updated
Jan 11, 2023
The default serialization used by Plug session may result in code execution
in certain situations. Keep in mind, however, the session cookie is signed
and this attack can only be exploited if the attacker has access to your
secret key as well as your signing/encryption salts. We recommend users to
change their secret key base and salts if they suspect they have been leaked,
regardless of this vulnerability.
References