CVE-2026-17552

{
  "id": "CVE-2026-17552",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-27T18:16:54.150",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.\n\nWhen the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/').\n\nWhen the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.\n\nFor example, a rewrite base of \"https://example.com\" with the submitted request \"GET @192.168.1.2/\" will send a request to \"https://[email protected]/\", with the rendered content returned to the attacker.\n\nThis allows an attacker to access internal or restricted hosts that only the webserver has access to."
    },
    {
      "lang": "es",
      "value": "Las versiones de Plack::App::Prerender anteriores a la 0.3.0 para Perl pueden actuar como proxy hacia un host arbitrario mediante la concatenación no validada de REQUEST_URI en la llamada.\n\nCuando la base de reescritura es una cadena de texto simple, la REQUEST_URI se le añade, sin verificar que la ruta comience con una barra inclinada (’/’).\n\nCuando la base de reescritura no contiene una ruta (que es el estándar dado en el SYNOPSIS), un atacante puede crear una solicitud que cambia el nombre de host. Un objetivo de solicitud que comienza con un signo de arroba (’@’) cambia la base a un componente de información de usuario (userinfo) de RFC 3986.\n\nPor ejemplo, una base de reescritura de ’https://example.com’ con la solicitud enviada ’GET @192.168.1.2/’ enviará una solicitud a ’https://[email protected]/’, con el contenido renderizado devuelto al atacante.\n\nEsto permite a un atacante acceder a hosts internos o restringidos a los que solo el servidor web tiene acceso."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "RRWO",
          "product": "Plack::App::Prerender",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Plack-App-Prerender",
          "programFiles": [
            "lib/Plack/App/Prerender.pm"
          ],
          "programRoutines": [
            {
              "name": "Plack::App::Prerender::call"
            }
          ],
          "repo": "https://github.com/robrwo/perl-Plack-App-Prerender",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.3.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T13:46:46.867311Z",
          "id": "CVE-2026-17552",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/robrwo/perl-Plack-App-Prerender/commit/2d793dd69e2b6f4e469618ee742bd8402677202d.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/robrwo/perl-Plack-App-Prerender/security/advisories/GHSA-6x4w-x68j-ppqq",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/RRWO/Plack-App-Prerender-v0.3.0/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/28/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}