========================================================================
CVE-2014-125112 CPAN Security Group
========================================================================
CVE ID: CVE-2014-125112
Distribution: Plack-Middleware-Session
Versions: through 0.21
MetaCPAN: https://metacpan.org/dist/Plack-Middleware-Session
VCS Repo: https://github.com/plack/Plack-Middleware-Session
Plack::Middleware::Session::Cookie versions through 0.21 for Perl
allows remote code execution
Description
-----------
Plack::Middleware::Session::Cookie versions through 0.21 for Perl
allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security
vulnerability where it allows an attacker to execute arbitrary code on
the server during deserialization of the cookie data, when there is no
secret used to sign the cookie.
Problem types
-------------
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
Workarounds
-----------
Set the "secret" option.
Solutions
---------
Upgrade Plack::Middleware::Session to version 0.23 or later (ideally
version 0.36 or later), and set the "secret" option.
References
----------
https://gist.github.com/miyagawa/2b8764af908a0dacd43d
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes
Timeline
--------
- 2014-08-11: Vulnerability disclosed by MIYAGAWA.
- 2014-08-11: Version 0.22 released that warns when the "secret" option
is not set.
- 2014-08-11: Version 0.23-TRIAL released that requires the "secret"
option to be set.
- 2014-09-05: Version 0.24 released. Same as 0.23 but not a trial
release.
- 2016-02-03: Version 0.26 released. Documentation improved with
SYNOPSIS giving an example of how to set the "secret" option.
- 2019-01-26: CPANSA-Plack-Middleware-Session-Cookie-2014-01 assigned
in CPAN::Audit::DB
- 2019-03-09: CPANSA-Plack-Middleware-Session-2014-01 reassigned in
CPAN::Audit::DB
- 2025-07-08: CVE-2014-125112 assigned by CPANSec.
Credits
-------
mala (@bulkneets), finder
