Plug vulnerabilities

Plug has an efficiency issue in the nested-parameter decoder that allows an unauthenticated remote attacker to cause denial of service. The decoding algorithm's complexity is quadratic in relation to the number of nesting levels, which can lead to server unresponsiveness.

In the elixir-plug plug library, Plug.Conn.Cookies.encode/2 builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes without neutralizing the ; delimiter. An application that places attacker-controlled data into a cookie value or attribute lets an attacker inject a ; to append or override cookie attributes.

The multipart parser in Plug.Parsers.MULTIPART does not enforce its :length budget against all consumed resources, allowing an unauthenticated attacker to cause denial of service. Part headers are not counted, and empty parts create temporary files, leading to inode, disk, and memory exhaustion. Affected versions: plug from 1.4.0-rc.0 before 1.16.6, 1.17.0 before 1.17.4, 1.18.0 before 1.18.5, 1.19.1 before 1.19.5, and 1.20.0 before 1.20.3.