Plug Secret Key Base Exposure via Stack Trace on Wrong-Typed Crypto Args

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments Vulnerability Type: Sensitive Information Disclosure (Secret Key Base Exposure) Trigger Condition: When Plug.Crypto functions receive arguments of the wrong type, the VM throws a FunctionClauseError. The error stack trace includes the actual argument values (such as the secret key base). If these arguments are logged or exposed to external systems, it leads to key leakage. CVSS Score: 5.1 / 10 (Medium Severity) Release Date: 2020-10-06 Impact Scope Affected Packages: - (v1.6.3 ~ v1.7.0) - (v1.6.0 ~ v2.2.1) Affected Functions: - (with non-nil key argument) - (with non-nil key argument) - (with non-nil key argument) - (with non-nil key argument) Impact Scenarios: - Logging of error stack traces - Error messages sent to external systems - Error messages stored in persistent storage Potential Risks: Attackers can use the leaked secret key base to forge session cookies, bypass authentication, or access protected resources. Remediation Fixed Versions: - → v1.7.0 - → v2.2.1 Recommended Actions: - Upgrade affected packages to the fixed versions - Review logging configurations to avoid recording error stack traces containing sensitive arguments - Check for historical logs that may have already leaked keys; rotate keys if necessary > ⚠️ Note: The page does not provide a POC or exploit code. Exploitation relies on argument values exposed in error stack traces; keys can be obtained via logs or error responses without requiring additional code.

Goal Reached Thanks to every supporter — we hit 100%!

Plug Secret Key Base Exposure via Stack Trace on Wrong-Typed Crypto Args

More from this source