Executive brief
Reverse::Proxy is a Perl module that forwards HTTP requests to upstream servers. Versions before 0.04 fail to properly encode path data when constructing upstream requests, allowing an attacker to inject additional HTTP requests through careful URL crafting. An attacker can use this to access upstream resources that the proxy's own security rules would normally block, or to poison keep-alive connection pools and affect other clients.
Technical details
The vulnerability is an HTTP request smuggling flaw (CWE-444) in Reverse::Proxy's handling of PSGI PATH_INFO. The PSGI specification hands PATH_INFO to applications percent-decoded; the proxy then appends this raw byte string to the upstream base URL without re-encoding it. When writing an Upgrade tunnel request line, the proxy serializes the URL without validating or encoding special characters. An attacker can inject CRLF bytes (via %0d%0a in the original URL) or truncate the request line with decoded space, '?', or '#' characters. This causes the upstream server to interpret data after the injected CRLF as a separate HTTP request, which is attributed to the proxy itself on keep-alive connections, bypassing the proxy's routing controls. Network-reachable, requires only an HTTP client capable of sending the crafted URL. Fixed in version 0.04.
Affected products
- LNATION Reverse::Proxy before 0.04
Timeline
- 2026-08-23: disclosed