Approved changes feed: RSS · Atom
cpe:2.3:a:rrwo:plack::app::prerender:*:*:*:*:*:*:*:*
part: a version: update: app
| Vendor | Rrwo (b5300a69-c4f4-5cc7-a4bb-65304bf38389) |
|---|---|
| Product | Plack (6c36196f-4fe3-545f-88fe-d46bf7998abd) |
| Edition | |
| Language | prerender |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-17552 |
vulnerable | 2026-07-29 00:26:18.810830 |
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.
When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/').
When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.
For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://example.com@192.168.1.2/", with the rendered content returned to the attacker.
This allows an attacker to access internal or restricted hosts that only the webserver has access to.
Published: 2026-07-27T18:04:47.993Z
Updated: 2026-07-28T13:47:10.576Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.