Read the docs
TI-2026-14395 Aliases CVE-2026-17552

Server-side request forgery in RRWO Plack::App::Prerender

Priority MEDIUM 48CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component. For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://[email protected]/", with the rendered content returned to the attacker. This allows an attacker to access internal or restricted hosts that only the webserver has access to.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Fixed Plack::App::Prerender (RRWO): 0.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RRWOPlack::App::Prerenderbefore 0.3.00.3.0Patch availableCNA
  • Plack::App::Prerender VendorRRWO Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA

Remediation

  • Fix · CNA Plack::App::Prerender (RRWO) Fixed in 0.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-17552

References

Patch 1

Advisory 1

Other 1

  • TI-2026-13955 OS command injection in RRWO Catalyst::View::Wkhtmltopdf CVSS 3.1CRITICAL 9.8
  • TI-2026-34943 Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts CVSS 3.1CRITICAL 9.1
  • TI-2026-34345 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections CVSS 3.1HIGH 8.2
  • TI-2026-15909 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set… CVSS 3.1HIGH 7.5
  • TI-2026-36790 Uncontrolled recursion in RRWO Net::CIDR::Set CVSS 3.1HIGH 7.5
  • TI-2026-34944 Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences