[<prev] [next>] [day] [month] [year] [list]
Message-ID: <cd959b4f-894a-4341-8239-a00a406a1046@cpansec.org>
Date: Mon, 27 Jul 2026 19:11:29 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-17552: Plack::App::Prerender versions before 0.3.0 for Perl
can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in
call
========================================================================
CVE-2026-17552 CPAN Security Group
========================================================================
CVE ID: CVE-2026-17552
Distribution: Plack-App-Prerender
Versions: before 0.3.0
MetaCPAN: https://metacpan.org/dist/Plack-App-Prerender
VCS Repo: https://github.com/robrwo/perl-Plack-App-Prerender
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an
arbitrary host via unvalidated REQUEST_URI concatenation in call
Description
-----------
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an
arbitrary host via unvalidated REQUEST_URI concatenation in call.
When the rewrite base is a plain string, the REQUEST_URI is appended to
it, with no check that the path starts with a forward slash ('/').
When the rewrite base does not contain a path (which is the standard
given in the SYNOPSIS), an attacker can create a request that changes
the hostname. A request target starting with an at-sign ('@') changes
the base to a RFC 3986 userinfo component.
For example, a rewrite base of "https://example.com" with the submitted
request "GET @192.168.1.2/" will send a request to
"https://example.com@....168.1.2/", with the rendered content returned
to the attacker.
This allows an attacker to access internal or restricted hosts that
only the webserver has access to.
Problem types
-------------
- CWE-918 Server-Side Request Forgery (SSRF)
Workarounds
-----------
For deployments that cannot be upgraded, change the rewrite to a
function that validates the path before appending it.
Solutions
---------
Upgrade to version 0.3.0 or later.
References
----------
https://github.com/robrwo/perl-Plack-App-Prerender/security/advisories/GHSA-6x4w-x68j-ppqq
https://metacpan.org/release/RRWO/Plack-App-Prerender-v0.3.0/changes
https://github.com/robrwo/perl-Plack-App-Prerender/commit/2d793dd69e2b6f4e469618ee742bd8402677202d.patch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
