Full Report
Erlang security advisory (AV26-870)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Erlang/OTP
## CVE Details
- **CVE ID:** CVE-2024-39918 (and potentially others referenced in advisory AV26-870)
- **CVSS Score:** 7.5 (High) - *Based on current industry mapping for associated OTP vulnerabilities*
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command)
## Affected Systems
- **Products:** Erlang/OTP
- **Versions:**
- OTP 27.0 versions prior to 27.0.1
- OTP 26.2 versions prior to 26.2.5.2
- OTP 25.3 versions prior to 25.3.2.14
- **Configurations:** Systems utilizing the `merl` module within the syntax tools or specific compiler functions that process untrusted input.
## Vulnerability Description
The primary vulnerability involves an OS Command Injection flaw. In affected versions, certain functions (specifically within the `merl` module) do not properly sanitize input when interacting with the underlying operating system. An attacker can craft malicious input that, when processed by a vulnerable application, allows for the execution of arbitrary commands on the host operating system with the privileges of the Erlang runtime.
## Exploitation
- **Status:** PoC available / Publicly disclosed
- **Complexity:** Low
- **Attack Vector:** Network (if the application processes remote user-supplied data through the affected modules)
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
The following versions have been released to address these security flaws:
- **OTP 27.0.1**
- **OTP 26.2.5.2**
- **OTP 25.3.2.14**
Users are strongly encouraged to upgrade to the latest patch release within their respective major version branch.
### Workarounds
- Ensure that untrusted input is never passed directly to `merl:quote` or similar metaprogramming functions.
- Implement strict input validation and sanitization (allow-listing) if the application logic requires processing external data through compiler-related modules.
## Detection
- **Indicators of Compromise:** Unusual child processes spawned by the `beam.smp` process; unexpected outbound network connections originating from the Erlang runtime.
- **Detection methods:** Audit codebase for usage of the `merl` module and verify the source of the data being passed to its functions. Utilize Static Analysis Security Testing (SAST) tools configured to flag OS command injection patterns in Erlang.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/erlang/otp/security/advisories/GHSA-m5vv-6r4j-j38p
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/erlang-security-advisory-av26-870
- **Erlang Downloads:** hxxps[://]www[.]erlang[.]org/downloads