CVE-2020-15150
📋 TL;DR
This vulnerability in the Paginator Elixir/Hex package allows remote attackers to execute arbitrary code by manipulating input parameters to the paginate() function. All users of Paginator versions prior to 1.0.0 are affected. The vulnerability enables complete system compromise through remote code execution.
💻 Affected Systems
- Paginator (Elixir/Hex package)
📦 What is this software?
Paginator by Duffel
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the server, allowing data theft, lateral movement, and persistent access.
Likely Case
Remote code execution leading to application compromise, data exfiltration, and potential deployment of malware or ransomware.
If Mitigated
No impact if patched to version 1.0.0 or if proper input validation and sandboxing are implemented.
🎯 Exploit Status
Exploitation requires only manipulation of input parameters to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0
Vendor Advisory: https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj
Restart Required: Yes
Instructions:
1. Update mix.exs to specify paginator version '~> 1.0.0'. 2. Run 'mix deps.update paginator'. 3. Recompile and restart your application.
🔧 Temporary Workarounds
Input Validation Workaround
allImplement strict input validation and sanitization for all parameters passed to paginate() function
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all paginate() function parameters
- Deploy network segmentation and restrict access to affected applications
🔍 How to Verify
Check if Vulnerable:
Check mix.lock or mix.exs for paginator version. If version is <1.0.0, the system is vulnerable.Check Version:
grep -A 2 'paginator' mix.lockVerify Fix Applied:
Verify paginator version is >=1.0.0 in mix.lock and test paginate() function with malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Elixir application
- Suspicious paginate() function calls with unexpected parameters
Network Indicators:
- Outbound connections from application to unexpected destinations
- Command and control traffic patterns
SIEM Query:
source='application_logs' AND (message LIKE '%paginate%' AND (message LIKE '%exec%' OR message LIKE '%system%' OR message LIKE '%eval%'))🔗 References
- https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations
- https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8
- https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj
- https://hex.pm/packages/paginator
- https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations
- https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8
- https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj
- https://hex.pm/packages/paginator
