CVE-2026-17552: Plack::App::Prerender SSRF Vulnerability

CVE-2026-17552 Overview

CVE-2026-17552 is a Server-Side Request Forgery (SSRF) vulnerability in the Perl module Plack::App::Prerender before version 0.3.0. The flaw lives in the module's call method, which concatenates the incoming REQUEST_URI to the configured rewrite base without validating that the path starts with a forward slash. An attacker can craft a request beginning with an at-sign (@) to transform the base URL's host component into an RFC 3986 userinfo component, redirecting the proxied request to an arbitrary host. The rendered response is returned to the attacker, exposing internal or restricted services reachable only by the webserver.

Critical Impact
Unauthenticated network attackers can pivot the prerendering proxy into arbitrary internal hosts, breaching network segmentation and exfiltrating restricted content [CWE-918].

Affected Products

Plack::App::Prerender for Perl, all versions prior to 0.3.0
Perl web applications using Plack::App::Prerender with a plain-string rewrite base lacking a path component
Deployments following the module's SYNOPSIS configuration example (for example, rewrite => "https://example.com")

Discovery Timeline

2026-07-27 - CVE-2026-17552 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-17552

Vulnerability Analysis

Plack::App::Prerender is a Plack application that proxies requests to a prerendering service. In vulnerable releases, the call handler builds the outbound target URL by string-concatenating the client-supplied REQUEST_URI onto the configured rewrite base. When the rewrite base is a bare origin such as https://example.com — the exact form shown in the module's SYNOPSIS — the concatenation is directly influenced by attacker-controlled bytes.

RFC 3986 defines the authority component of a URL as [ userinfo "@" ] host [ ":" port ]. When an attacker submits GET @192.168.1.2/, the resulting URL becomes https://example.com@192.168.1.2/. Standard HTTP clients parse example.com as the userinfo field and send the request to 192.168.1.2 instead. The proxy then returns the fetched content to the attacker.

Root Cause

The root cause is missing input validation on REQUEST_URI before URL construction. The code assumed the request target would always begin with /, but per RFC 7230 the request target is attacker-controlled and can start with other characters. No parser is used to reconstruct a safe URL; instead, raw concatenation permits authority injection.

Attack Vector

Exploitation requires only a single unauthenticated HTTP request to a vulnerable endpoint. The attacker sends a request line whose target begins with @ followed by an internal hostname or IP address. Because the module accepts and forwards the crafted target, this yields SSRF against any host reachable from the web server, including cloud metadata services, internal admin panels, or private APIs.

text

# Patch note added to Changes (Source: github.com/robrwo/perl-Plack-App-Prerender commit 2d793dd)
  [Security]
  - Requests with no forward slash are now blocked, as these may allow the host to be changed (CVE-2026-17552).

text

# Documentation update in lib/Plack/App/Prerender.pm (Source: github.com/robrwo/perl-Plack-App-Prerender commit 2d793dd)
If L</rewrite> is a URL prefix string, then the path must start with a forward slash, otherwise it will return an HTTP 400.
This is to prevent security issues where the hostname is changed and the prerendering proxy is abused

If L</rewrite> is a code reference, then any path will be accepted,
but it is assumed that the developer will check for requests without a forward slash and handle them appropriately.

Detection Methods for CVE-2026-17552

Indicators of Compromise

HTTP access logs containing request targets that begin with @, such as GET @10.0.0.5/ HTTP/1.1
Outbound HTTP requests from the Plack web server to internal IP ranges (RFC 1918) or cloud metadata endpoints (169.254.169.254)
Unexpected userinfo-style URLs in proxy or egress logs, for example https://example.com@attacker-target/
Elevated 4xx or 5xx response codes from the prerender backend correlated with unusual request paths

Detection Strategies

Inspect web server access logs for request lines where the URI does not begin with / or a known scheme, using regex such as ^[A-Z]+ [^/]
Correlate application-layer requests with egress network flows to identify prerender proxy calls hitting internal subnets
Deploy a WAF or reverse proxy rule that rejects request targets containing @ before the first /

Monitoring Recommendations

Alert on any outbound connection from the Plack application host to private address space that lacks a documented business purpose
Track the version of Plack::App::Prerender installed across Perl deployments via package inventory
Enable verbose logging on the prerender client to capture the fully resolved target URL for each request

How to Mitigate CVE-2026-17552

Immediate Actions Required

Upgrade Plack::App::Prerender to version 0.3.0 or later from CPAN
Audit the rewrite configuration in all Plack applications and verify whether a plain-string base without a path is in use
Review recent access logs for exploitation attempts using the @ prefix pattern
Restrict outbound network access from the Plack host to only the intended prerender service using firewall egress rules

Patch Information

The fix is included in Plack-App-Prerender v0.3.0 on MetaCPAN. The upstream commit is available as a GitHub patch, and coordinated disclosure details are in the GitHub Security Advisory GHSA-6x4w-x68j-ppqq. The patch rejects any request whose target does not begin with a forward slash, returning HTTP 400. Additional discussion is available on the OpenWall oss-security list.

Workarounds

Configure the rewrite option as a URL that includes an explicit trailing path such as https://example.com/ instead of https://example.com
Use a code reference for rewrite and validate that the incoming path begins with / before delegating to the prerender client
Place a reverse proxy in front of the Plack application that strips or rejects request targets not beginning with /
Apply egress filtering to prevent the web server from reaching internal networks or cloud metadata endpoints

bash

# Update Plack::App::Prerender via cpanm to the patched release
cpanm RRWO/Plack-App-Prerender-v0.3.0.tar.gz

# Verify installed version
perl -MPlack::App::Prerender -e 'print $Plack::App::Prerender::VERSION, "\n"'