I have released Plug v1.3.3, v1.2.4, v1.1.8, v1.0.5 that also allows structs, bitstrings and improper lists to be deserialized.
Finally, when this thread is 7 days old, I will provide more information about the vulnerabilities. So if you haven’t upgraded yet, please do so.
Hi everyone,
Here is more information on the null byte issue, as reported by NCC Group:
The “static” plug, used to serve assets in Plug-based web frameworks, serves two primary functions: locating the requested file, and setting the response content type. The asset content type is set dynamically, using the
Mime.from_pathfunction. For example, a request for the file “images/phoenix.png” will result in a content type of “image/png.” However, if the request is updated to “images/phoenix.png%00.html,” the resulting content type will be set to “text/html.”
Some have mentioned the vulnerability could cause a “access control” issue, causing one user to see files permitted by other users, however I don’t believe that to be possible because:
Plug.Static doesn’t provide any control access. All files are available to all users
If you are implementing control access by plugging Plug.Static on an authenticated route, it is most likely that you are doing authentication based on the path prefix rather than the path suffix and any “weird character”, such as a null byte, would make authentication fail
However, it is important to mention that this vulnerability may affect you even if you don’t use null byte. A bug report has been filled on Erlang/OTP issues tracker.
I will provide more information about the other vulnerability soon.
The access control issue @josevalim mentions is something I described in this post. I agree that most sites would probably implement sharing at the directory level, but some cloud syncing services have more fine-grained access control, for example for use in an enterprise environment.
Still, even if the example is a bit obscure, the important takeaway is this: until the underlying issue in the Erlang runtime is resolved, the path you’re inspecting and the path that’s actually being read from (or written to) may differ, so any application that build paths with user input should probably implement null-byte screening.
Thank you, I couldn’t quite remember where I saw it. 
It was also slightly referenced on this thread in regards to :only and :only_matching (which are also prefix based and therefore not vulnerable).
from Redirecting…
While I don’t believe this poises a security issue in OTP itself, I believe the platform would be safer if it raised when a string or binary with a null byte is given anytime we are interacting with the filesystem.
so you were mostly right but it is indeed a relatively minor issue
The 2nd issue (cookie de-serialization) is only minor issue since Elixir/Erlang does not mix data and code into objects.
Rails had a similar issue back in a day where it would de-serialize stuff from params/cookie (don’t remember exactly) into classes. Combine that with ability to re-define classes at run time and you have remote code execution at it’s finest.
RE the quoted erlang bug report text:
I don’t think @josevalim intends to say that the null byte issue with Plug is minor, just that this isn’t necessarily a security issue in OTP itself.
that’s what I said, my opinion may or may not be the same as Jose’s
To be precise about what I meant: the vulnerability might not be minor, but it is less severe than I thought (hence “relatively minor”).
Thanks for staying on top of this! It got me thinking..
It’d be nice to build some security vulnerability reporting features into mix & hex.
Perhaps a package author could flag a particular version as containing a vulnerability, and then when running commands like mix deps.get, we’d get a warning about that vulnerability.
I think that could help the ecosystem as a whole stay on top of security issues as Elixir grows.