Executive brief
Plack::App::Prerender is a Perl library used to pre-render web pages for search engines and crawlers. A security flaw allows an attacker to trick the server into fetching and returning content from internal or restricted websites that are not normally accessible from the internet. This could lead to the exposure of sensitive internal data, such as cloud metadata or administrative interfaces.
Technical details
Plack::App::Prerender before version 0.3.0 is vulnerable to Server-Side Request Forgery (SSRF) via the 'call' method. When the 'rewrite' configuration is a plain string, the application concatenates the user-supplied REQUEST_URI without validating that it begins with a forward slash. An attacker can provide a request target starting with an '@' symbol (e.g., '@192.168.1.2/'), which causes the original rewrite base to be interpreted as RFC 3986 userinfo, effectively redirecting the proxy request to an arbitrary host. This allows unauthenticated remote attackers to exfiltrate content from internal services, loopback interfaces, or cloud instance metadata. The issue is fixed in version 0.3.0 by blocking requests that do not start with a forward slash.
Affected products
- RRWO Plack::App::Prerender < 0.3.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Fixed in version 0.3.0
- 2026-07-27: advisory