Dancer
Monthly
Google OAuth2 login can be fully impersonated in the Perl module Dancer::Plugin::Auth::Google (all versions through 0.07) because its default user agent is initialised with SSL_verify_mode set to SSL_VERIFY_NONE, disabling TLS certificate validation on calls to googleapis.com. A network man-in-the-middle can intercept the OAuth2 token exchange and userinfo fetch and return a forged access_token and profile, authenticating as any Google user to the Dancer application. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but an upstream fix (PR #5) is available.
Dancer::Session::Abstract through version 1.3522 generates cryptographically weak session identifiers by combining predictable inputs (file path, process ID, epoch time) with an insufficiently-seeded Perl rand() function, allowing remote attackers to predict valid session IDs and hijack user sessions without authentication. The vulnerability affects Perl-based web applications using Dancer framework's default session handling; active exploitation is not confirmed but the attack requires only guessing a session ID, making it practically exploitable.
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Google OAuth2 login can be fully impersonated in the Perl module Dancer::Plugin::Auth::Google (all versions through 0.07) because its default user agent is initialised with SSL_verify_mode set to SSL_VERIFY_NONE, disabling TLS certificate validation on calls to googleapis.com. A network man-in-the-middle can intercept the OAuth2 token exchange and userinfo fetch and return a forged access_token and profile, authenticating as any Google user to the Dancer application. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but an upstream fix (PR #5) is available.
Dancer::Session::Abstract through version 1.3522 generates cryptographically weak session identifiers by combining predictable inputs (file path, process ID, epoch time) with an insufficiently-seeded Perl rand() function, allowing remote attackers to predict valid session IDs and hijack user sessions without authentication. The vulnerability affects Perl-based web applications using Dancer framework's default session handling; active exploitation is not confirmed but the attack requires only guessing a session ID, making it practically exploitable.
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.