CVE-2014-125112: Miyagawa Plack RCE Vulnerability

CVE-2014-125112 Overview

CVE-2014-125112 is a remote code execution vulnerability in Plack::Middleware::Session::Cookie versions through 0.21 for Perl. The middleware deserializes session cookie data without verifying a signing secret. An attacker can craft a malicious cookie that executes arbitrary Perl code on the server during deserialization. The flaw is classified under [CWE-565: Reliance on Cookies without Validation and Integrity Checking].

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on any Perl Plack application that uses Plack::Middleware::Session::Cookie without a configured secret, leading to full server compromise.

Affected Products

Plack::Middleware::Session::Cookie versions through 0.21
Perl applications using the Plack::Middleware::Session distribution prior to 0.23-TRIAL
Web applications deploying Plack/PSGI session cookie middleware without a signing secret

Discovery Timeline

2026-03-26 - CVE CVE-2014-125112 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2014-125112

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw. Plack::Middleware::Session::Cookie stores session state directly in a client-side cookie. When the middleware reads the cookie, it deserializes the encoded payload back into Perl data structures. Without a signing secret, the middleware cannot detect tampering. An attacker who supplies a forged cookie controls the serialized stream the server processes.

Perl deserialization through Storable and similar modules can instantiate objects whose DESTROY or STORABLE_thaw methods run code. Crafted payloads abuse this behavior to achieve arbitrary code execution under the web server's user context.

Root Cause

The root cause is missing integrity verification on attacker-controlled input. When the application omits the secret configuration option, the middleware does not compute or validate a Hash-based Message Authentication Code (HMAC) over the cookie. The server therefore treats untrusted bytes as a trusted serialized object graph.

Attack Vector

The attack is performed remotely over the network with no authentication and no user interaction. An attacker submits a single HTTP request containing a forged session cookie. When the middleware processes the request, deserialization triggers execution of attacker-supplied Perl code. See the OpenWall OSS Security Post and the GitHub Gist Resource for proof-of-concept technical details published by the maintainer.

Detection Methods for CVE-2014-125112

Indicators of Compromise

HTTP requests containing unusually long, base64-encoded Set-Cookie or Cookie header values targeting the Plack session cookie name.
Web server processes spawning unexpected child processes such as /bin/sh, perl -e, or outbound network connections shortly after handling a request.
New cron jobs, SSH authorized keys, or files written to web root directories by the Perl application user.

Detection Strategies

Inspect Plack/PSGI application configuration for instances of Plack::Middleware::Session::Cookie invoked without a secret parameter.
Audit installed CPAN modules for Plack::Middleware::Session versions at or below 0.21 using cpan -l or perl -MPlack::Middleware::Session -e 'print $Plack::Middleware::Session::VERSION'.
Apply web application firewall rules that flag session cookies containing serialized Perl markers such as Storable headers or pst0.

Monitoring Recommendations

Log and review all Set-Cookie and inbound Cookie header anomalies for the Plack session cookie.
Monitor process trees of Perl/Plack web workers for unexpected execution of shells, interpreters, or networking utilities.
Alert on outbound connections originating from web application hosts to untrusted destinations following inbound HTTP traffic.

How to Mitigate CVE-2014-125112

Immediate Actions Required

Upgrade Plack::Middleware::Session to version 0.23-TRIAL or later, which addresses the deserialization behavior. See the MetaCPAN Release Changes.
Configure every instance of Plack::Middleware::Session::Cookie with a strong, randomly generated secret value to enable cookie signing.
Rotate any existing session secrets and invalidate active sessions after patching.

Patch Information

The maintainer released Plack-Middleware-Session-0.23-TRIAL, which requires a secret for the cookie session store and rejects unsigned cookies. Operators should upgrade through CPAN and redeploy affected applications. Confirm the installed version with cpanm --info Plack::Middleware::Session.

Workarounds

Switch from Plack::Middleware::Session::Cookie to a server-side session store such as Plack::Session::Store::File or Plack::Session::Store::Cache until upgrade is possible.
If immediate patching is not feasible, deploy a reverse proxy or WAF rule that strips or rejects the application's session cookie from external requests.
Restrict the Perl web worker's filesystem and network privileges using OS-level sandboxing to limit post-exploitation impact.

bash

# Configuration example: enforce cookie signing in Plack app.psgi
use Plack::Builder;

builder {
    enable 'Session::Cookie',
        secret      => $ENV{PLACK_SESSION_SECRET},  # required, 32+ random bytes
        session_key => 'psgi_session',
        httponly    => 1,
        secure      => 1;
    $app;
};