CVE-2026-17552 in Plack::App::Prerender
Summary
by MITRE • 07/27/2026
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.
When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/').
When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.
For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://[email protected]/", with the rendered content returned to the attacker.
This allows an attacker to access internal or restricted hosts that only the webserver has access to.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in Plack::App::Prerender versions prior to 030 represents a critical path traversal and host substitution flaw that enables arbitrary remote code execution through manipulated request URIs. This security weakness stems from insufficient input validation during the REQUEST_URI concatenation process, creating a pathway for attackers to bypass normal access controls and proxy requests to unintended destinations. The flaw specifically manifests when the application processes rewrite base configurations without proper sanitization of user-supplied URI components.
The technical implementation of this vulnerability exploits the lack of validation checks on the REQUEST_URI parameter when it gets concatenated with the configured rewrite base. When the rewrite base is defined as a plain string, the system blindly appends the incoming REQUEST_URI without verifying that the path component begins with a forward slash character. This omission creates an opening for attackers to manipulate the target host through carefully crafted requests. The vulnerability becomes particularly dangerous when the rewrite base lacks explicit path components, as is common in standard implementations according to the SYNOPSIS documentation.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it enables attackers to access internal systems that should normally be protected from external reach. Through the manipulation of request targets beginning with an at-sign character, malicious actors can effectively transform the base URL into a format containing RFC 3986 userinfo components. This transformation allows the webserver to make requests to arbitrary IP addresses or hostnames that would otherwise be inaccessible through normal network routing. The example demonstrates how a simple request targeting "@192.168.1.2/" can cause the application to submit requests to internal networks, effectively turning the web server into an unauthorized proxy for internal resources.
Security researchers categorize this vulnerability under CWE-20, which addresses improper input validation, and it aligns with ATT&CK technique T1071.004 related to application layer protocol usage for command and control communications. The flaw essentially creates a man-in-the-middle attack vector where the vulnerable application becomes an unwitting intermediary for accessing restricted network resources. Organizations using affected versions of Plack::App::Prerender face significant risk exposure, particularly in environments where internal systems are not properly segmented from external access points.
The recommended mitigation strategy involves upgrading to Plack::App::Prerender version 030 or later, which implements proper input validation and sanitization of REQUEST_URI components. Additionally, administrators should implement strict input filtering at the web server level, validate all URI components before concatenation, and consider implementing network segmentation to limit access to internal resources. The vulnerability also underscores the importance of validating all user-supplied data in proxy and rewrite configurations, as highlighted by industry standards such as OWASP Top Ten and NIST cybersecurity guidelines for preventing injection flaws in web applications.