Executive brief
Punk is a Perl web framework that manages user sessions via signed cookies. Versions before 0.18 fail to enforce a required cryptographic secret, allowing attackers to forge arbitrary session cookies with fabricated user identities or privileges if the framework is deployed without explicit secret configuration. This can lead to account takeover and unauthorized access to protected features.
Technical details
Punk's session keyword does not validate or require a secret parameter when declared, and defaults the HMAC-SHA256 signing key to an empty string if one is not provided, undefined, or empty. An attacker familiar with the session cookie format can craft valid cookies offline using the zero-length key, forging any session data such as user identifiers or role attributes. The vulnerability requires only knowledge of the cookie structure and the absence of a secret in the configuration; no network interaction or authentication is needed to mint malicious cookies. Versions 0.18 and later address this by enforcing a non-empty secret at session declaration time.
Affected products
- Punk Punk before 0.18
Timeline
- 2026-08-22: disclosed