Remote code execution in Elixir-based Paginator

guest · Nov 26, 2020

RCE bug in Elixir-based Paginator could expose users’ cloud assets
Developers patch vulnerability in open source project within 24 hours
November 26, 2020
https://portswigger.net/daily-swig/rce-bug-in-elixir-based-paginator-could-expose-users-cloud-assets

A remote code execution (RCE) vulnerability that could expose a users’ cloud assets has been patched in the open source, Elixir-based Paginator project.

Discovered by security expert Peter Stöckli, the bug could be exploited by attackers to tamper with or hijack cloud assets belonging to companies utilizing Paginator.

“Since Duffel seemed to use Paginator for its own REST API it seems likely that an attacker exploiting this vulnerability would have been able to execute code on Duffel’s (cloud) assets,” the researcher noted.
Click to expand...

Déja vu
The researcher noted that this is not the first incident where binary_to_term and untrusted data sources could lead to severe vulnerabilities. Four years ago, for example, Griffin Byatt discovered a separate vulnerability in the Elixir Plug caused by the Enumerable protocol.
Mitigations are documented here.
Click to expand...

Speaking to The Daily Swig, Stöckli said it is “hard to say” what the RCE’s real-world applications could have beyond Duffel systems, and there may not be any “as far as he knows”.

After Stöckli privately disclosed the vulnerability to Duffel, the UK startup took less than a day to take action and patch the security issue. In addition, despite not having an official bug bounty program, the company paid the researcher a £1000 reward.
Click to expand...

Remote code execution in Elixir-based Paginator

In August of this year I found a remote code execution vulnerability in the Elixir-based Paginator open-source project from Duffel (a UK-based startup in the flight searching space). The vulnerability has the CVE number CVE-2020-15150 assigned.
Click to expand...

Log in or Sign up

Remote code execution in Elixir-based Paginator

guest Guest

Log in or Sign up

Remote code execution in Elixir-based Paginator

guest Guest

Useful Searches