CVE-2026-17552

Executive Summary

CVE-2026-17552 is an unvalidated proxy-to-arbitrary-host vulnerability in the Perl module Plack::App::Prerender prior to version 0.3.0. The flaw occurs when the rewrite_base is a plain string and the REQUEST_URI is appended without sanitization. An attacker can prepend an @ character to the request path to change the effective hostname, causing the server to proxy requests to internal or restricted hosts. This Server-Side Request Forgery (SSRF) allows attackers to read sensitive data from internal services, bypass network segmentation, and potentially pivot inside the infrastructure.

Supply Chain & Package Security

This vulnerability affects a Perl module distributed via CPAN. Users who install the Plack::App::Prerender package (cpan install Plack::App::Prerender) or include it in their project dependencies (e.g., cpanfile or Makefile.PL) are at risk. The affected component is a web middleware that pre-renders pages for JavaScript applications. Because Perl modules are often installed system-wide or deployed in containerized applications, the attack surface can be broad. There are no known backdoor indicators in the package, but the absence of input validation is a code-level security weakness.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – the vulnerability can be triggered over HTTP.
• Attack Complexity (AC): Low (L) – no special conditions required beyond a crafted request.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Changed (C) – the attack can reach resources beyond the original intended host.
• Confidentiality (C): High (H) – internal hosts may leak sensitive data.
• Integrity (I): None (N) – no direct data modification.
• Availability (A): None (N) – not affected.

Base Score: 8.6 (HIGH) – A critical SSRF allowing blind or interactive probing of internal networks.

Deep Dive & Mechanics

The Plack::App::Prerender module is designed to rewrite incoming requests to a back‑end prerendering service. When rewrite_base is configured as a plain string (e.g., https://example.com), the code constructs the target URL by concatenating the rewrite_base with the raw REQUEST_URI from the incoming request. This is typically done with code similar to:

my $url = $self->{rewrite_base} . $env->{REQUEST_URI};

The vulnerability arises because REQUEST_URI is not checked for leading characters that alter the URL structure. According to RFC 3986, a userinfo@host syntax can be injected. For instance:

• Normal: rewrite_base = "https://example.com" + REQUEST_URI = "/path" → https://example.com/path
• Exploit: rewrite_base = "https://example.com" + REQUEST_URI = "@192.168.1.2/" → https://example.com@192.168.1.2/

The resulting URL is interpreted by most HTTP clients (e.g., Perl’s LWP, libwww) as a request to 192.168.1.2 with userinfo set to example.com. The target host receives the request and the prerendered page (or any content) is returned to the attacker.

This allows:

• Access to internal services (e.g., http://169.254.169.254/latest/meta-data/ on cloud providers).
• Port scanning of internal hosts using the server’s connection.
• Chaining with other vulnerabilities for lateral movement.

Vulnerable vs. Patched Code

Vulnerable (before 0.3.0):

# In some version of Plack::App::Prerender (conceptual)
sub call {
    my ($self, $env) = @_;
    my $uri = $self->{rewrite_base} . $env->{REQUEST_URI};
    # ... fetch $uri and return response
}

Patched (0.3.0+):

The patch adds validation that the REQUEST_URI must start with a forward slash (/). This prevents the injection of an @ character because a path beginning with a forward slash cannot contain a userinfo component.

sub call {
    my ($self, $env) = @_;
    my $path = $env->{REQUEST_URI};
    return [400, [], ['Bad Request']] unless $path =~ m{^/};
    my $uri = $self->{rewrite_base} . $path;
    # ... fetch $uri and return response
}

The fix ensures that the appended path always starts with /, making it impossible to embed a host‑changing @ character before the hostname.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Perl web application using Plack::App::Prerender (version < 0.3.0) with rewrite_base set to a plain string like https://example.com.
• The vulnerable server must have network connectivity to internal targets.

Exploit Steps:

1. Identify the prerendering endpoint (e.g., /prerender or any route handled by Plack::App::Prerender).
2. Send a crafted HTTP request with a path beginning with @ followed by an internal IP or hostname.

Example using curl:

curl -v "http://vulnerable-server.com/prerender/@192.168.1.100/internal-endpoint"

The server will proxy the request to https://example.com@192.168.1.100/internal-endpoint, effectively making a request to http://192.168.1.100/internal-endpoint (the example.com part becomes userinfo and is ignored by the HTTP client).

To access cloud metadata (e.g., AWS):

curl -v "http://vulnerable-server.com/prerender/@169.254.169.254/latest/meta-data/"

The response will contain the target’s content if the internal host is reachable and the request is allowed.

Advanced: Use URL‑encoded characters or different protocols if the backend supports it (e.g., @127.0.0.1:8080).

Blue Team

Detection:

• Monitor web server access logs for URIs containing @ after the initial slash (e.g., GET /prerender/@...).
• Watch for outbound connections from the web server to unexpected internal IPs (e.g., 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12).
• Use network flow data to identify unusual destination ports (e.g., 22, 3306, 6379) originating from the web server.

Hunting Query Example (Splunk):

index=web sourcetype=access_combined uri_path=*@* | table time, src_ip, uri, dest_ip

Prevention:

• Apply the patch (upgrade to 0.3.0 or later).
• If upgrading is not immediately possible, add a reverse proxy (e.g., Nginx) that rewrites or rejects any request path containing @ before it reaches the Perl application.
• Restrict outbound firewall rules so that the web server can only communicate with authorized prerendering back‑ends.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule SSRF_Plack_Prerender_AtSign {
    meta:
        description = "Detects HTTP request URI with @ sign indicating SSRF exploit for CVE-2026-17552"
        author = "Valters IT"
        reference = "CVE-2026-17552"
        date = "2026-01-01"
    strings:
        $ssrf_pattern = /[?&]@[\w.-]+\//  // Matches @ followed by host in path or query
        $uri_start = "/"  // still need to ensure proper context
    condition:
        $ssrf_pattern and not (
            // Exclude legitimate uses (e.g., email addresses in query parameters)
            for any of them : ( them contains "/@" and not $uri_start at 0 )
        )
}

Sigma Rule

title: SSRF via Plack::App::Prerender - CVE-2026-17552
status: experimental
description: Detects HTTP requests with '@' character in URI path that may indicate SSRF exploitation
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "@" 
        cs-uri-stem|startswith: "/prerender/"
    condition: selection
fields:
    - src_ip
    - cs-uri-query
    - sc_status
falsepositives:
    - Legitimate use of '@' in query parameters (e.g., email) – check context
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-17552 Plack::App::Prerender SSRF attempt"; flow:to_server; http.uri; content:"@"; distance:0; http.uri; content:"/../"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Note: The Suricata rule above is a simplified example. Fine‑tune the pattern to match the actual request structure (e.g., /prerender/@...).

Remediation & Mitigation

Immediate Actions:

1. Upgrade Plack::App::Prerender to version 0.3.0 or later. On CPAN: cpan upgrade Plack::App::Prerender
2. If upgrade is not possible, implement a WAF rule that blocks any request containing @ in the URI path.
3. Restrict outbound network access from the web server to only essential hosts using egress firewalls. Deny access to internal IP ranges (RFC 1918, link‑local, etc.).

Long‑term Hardening:

• Conduct a code review of all proxy/perrender modules for similar concatenation issues.
• Use URL construction libraries that strictly enforce RFC compliance (e.g., URI->new in Perl with validation).
• Implement network segmentation to limit the blast radius of SSRF attacks.

Valters IT – DevSecOps & Threat Intelligence – 2026