CVE-2026-104380 in Punk
Summary
by MITRE • 10/06/2026
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.
On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it.
A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Perl-based web server implementations of Punk versions ranging from 0.48 up to, but not including, version 0.55 represents a critical logic flaw in the handling of HTTP/2 and HTTP/3 protocol upgrades. Specifically, the issue resides within the ps_serve_one handler function which incorrectly routes Extended CONNECT requests intended for WebSocket handshakes to standard GET route handlers without performing necessary origin validation checks. This architectural misconfiguration allows attackers to exploit the discrepancy between how different HTTP versions handle connection upgrade mechanisms, leading to a significant bypass of security controls that are otherwise effective against traditional cross-origin attacks.
In modern web architectures, establishing a WebSocket connection requires an initial handshake where the client sends an Extended CONNECT request rather than a standard GET or POST method. The server is expected to validate this request, particularly checking the Origin header to ensure the request originates from an authorized domain before upgrading the protocol. However, in the affected versions of Punk, when processing HTTP/2 and HTTP/3 traffic, the system mistakenly matches these Extended CONNECT requests against any available GET route definition. Because the routing logic prioritizes matching the connection upgrade as a standard resource retrieval operation, it bypasses the specific WebSocket route handlers where origin checks are typically enforced. Consequently, the server proceeds to evaluate the request using general GET handler logic, which does not include the stringent cross-origin policy enforcement required for secure socket upgrades.
The operational impact of this flaw is severe, enabling sophisticated Cross-Site WebSocket Hijacking attacks. An attacker can craft a malicious web page hosted on a different domain that attempts to open a WebSocket connection to any arbitrary path within the vulnerable application's namespace. Since the server accepts Extended CONNECT requests as valid GET routes without verifying their origin, it will respond with a 2xx status code if the underlying resource exists and is accessible via standard HTTP methods. This response allows the attacker’s script to determine whether specific endpoints exist or are active based on the open event of the WebSocket connection. Furthermore, if the endpoint requires authentication that has been compromised or bypassed through other means, the attacker could potentially establish a fully functional session hijacking channel, allowing for data exfiltration or unauthorized actions under the victim's credentials.
This vulnerability aligns with CWE-346, which describes Origin Validation Errors in cross-site request handling, and falls under the MITRE ATT&CK technique of T1505.002, specifically Web Session Cookie Theft via WebSocket hijacking. The lack of origin verification during the initial handshake phase effectively neutralizes Same-Origin Policy protections that are designed to prevent unauthorized access from different domains. Attackers can leverage this flaw for reconnaissance purposes by mapping out internal APIs or sensitive endpoints simply by observing connection success or failure states, thereby facilitating further exploitation attempts against authenticated users who have active sessions with the target application.
To mitigate this vulnerability, organizations must immediately upgrade their Punk installations to version 0.55 or later where these routing logic errors have been corrected. In addition to upgrading, developers should implement strict origin validation checks at the earliest possible stage of request processing for any endpoint that supports WebSocket upgrades. It is crucial to ensure that Extended CONNECT requests are explicitly routed through handlers dedicated to protocol upgrades rather than generic resource retrieval routes. Furthermore, implementing robust Content Security Policy headers with appropriate connect-src directives can provide an additional layer of defense by restricting which origins are permitted to establish WebSocket connections, thereby reducing the attack surface even if underlying routing logic remains susceptible in other contexts. Regular security audits focusing on HTTP/2 and HTTP/3 implementation details are recommended to identify similar misconfigurations in modern web server stacks.