CVE-2026-17552

{"id": "CVE-2026-17552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17552", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T13:46:46.867311Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/robrwo/perl-Plack-App-Prerender", "vendor": "RRWO", "product": "Plack::App::Prerender", "versions": [{"status": "affected", "version": "0", "lessThan": "0.3.0", "versionType": "custom"}], "packageName": "Plack-App-Prerender", "programFiles": ["lib/Plack/App/Prerender.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Plack::App::Prerender::call"}]}]}], "published": "2026-07-27T18:16:54.150", "references": [{"url": "https://github.com/robrwo/perl-Plack-App-Prerender/commit/2d793dd69e2b6f4e469618ee742bd8402677202d.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/robrwo/perl-Plack-App-Prerender/security/advisories/GHSA-6x4w-x68j-ppqq", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/RRWO/Plack-App-Prerender-v0.3.0/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.\n\nWhen the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/').\n\nWhen the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.\n\nFor example, a rewrite base of \"https://example.com\" with the submitted request \"GET @192.168.1.2/\" will send a request to \"https://example.com@192.168.1.2/\", with the rendered content returned to the attacker.\n\nThis allows an attacker to access internal or restricted hosts that only the webserver has access to."}, {"lang": "es", "value": "Las versiones de Plack::App::Prerender anteriores a la 0.3.0 para Perl pueden actuar como proxy hacia un host arbitrario mediante la concatenaci\u00f3n no validada de REQUEST_URI en la llamada.\n\nCuando la base de reescritura es una cadena de texto simple, la REQUEST_URI se le a\u00f1ade, sin verificar que la ruta comience con una barra inclinada (\u2019/\u2019).\n\nCuando la base de reescritura no contiene una ruta (que es el est\u00e1ndar dado en el SYNOPSIS), un atacante puede crear una solicitud que cambia el nombre de host. Un objetivo de solicitud que comienza con un signo de arroba (\u2019@\u2019) cambia la base a un componente de informaci\u00f3n de usuario (userinfo) de RFC 3986.\n\nPor ejemplo, una base de reescritura de \u2019https://example.com\u2019 con la solicitud enviada \u2019GET @192.168.1.2/\u2019 enviar\u00e1 una solicitud a \u2019https://example.com@192.168.1.2/\u2019, con el contenido renderizado devuelto al atacante.\n\nEsto permite a un atacante acceder a hosts internos o restringidos a los que solo el servidor web tiene acceso."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}