Description
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.

When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/').

When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.

For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://example.com@192.168.1.2/", with the rendered content returned to the attacker.

This allows an attacker to access internal or restricted hosts that only the webserver has access to.
Published: 2026-07-27
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Plack::App::Prerender versions before 0.3.0 for Perl may concatenate an unvalidated REQUEST_URI into the rewrite base, enabling an attacker to redirect the web server to arbitrary hosts. By crafting a request that changes the hostname – for example using a leading '@' to insert a userinfo component – the application can be coerced into sending traffic to internal or restricted servers. This effectively turns the public web endpoint into a proxy that exposes internal infrastructure, allowing attackers to retrieve internal resources without permission.

Affected Systems

The affected product is RRWO's Plack::App::Prerender Perl module, versions earlier than 0.3.0. No other vendors or versions are listed as affected by this advisory.

Risk and Exploitability

The vulnerability is trivially exploitable via a specially crafted HTTP request; no authentication is required. The exploitation path is straightforward: an attacker sends a request with a rewritten base that includes an arbitrary host, causing the server to forward the request. With a CVSS score of 9.1 and an EPSS score of <1%, the severity is high but the likelihood of exploitation remains low; the vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on August 3, 2026 at 16:59 UTC.

Remediation

Vendor Solution

Upgrade to version 0.3.0 or later.

Vendor Workaround

For deployments that cannot be upgraded, change the rewrite to a function that validates the path before appending it.

OpenCVE Recommended Actions

  • Upgrade Plack::App::Prerender to version 0.3.0 or later.
  • If an upgrade is not possible, modify the rewrite to a function that validates the requested path before concatenation, ensuring the host cannot be changed.
  • Implement network segmentation or firewall rules to block outbound traffic from the web server to internal networks, mitigating the impact of any remaining SSRF.

Generated by OpenCVE AI on August 3, 2026 at 16:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Rrwo
Rrwo plack::app::prerender
Vendors & Products Rrwo
Rrwo plack::app::prerender

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component. For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://example.com@192.168.1.2/", with the rendered content returned to the attacker. This allows an attacker to access internal or restricted hosts that only the webserver has access to.
Title Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call
Weaknesses CWE-918
References

Subscriptions

Rrwo Plack::app::prerender
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-07-28T13:47:10.576Z

Reserved: 2026-07-27T12:38:52.992Z

Link: CVE-2026-17552

cve-icon Vulnrichment

Updated: 2026-07-28T07:52:10.427Z

cve-icon NVD

Status : Deferred

Published: 2026-07-27T18:16:54.150

Modified: 2026-07-28T16:19:30.463

Link: CVE-2026-17552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:00:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)