Plack Middleware Session Cookie Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Plack::Middleware::Session::Cookie versions prior to 0.21 for Perl. The issue arises during the deserialization of cookie data when no secret is used to sign the cookie, allowing an attacker to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where the affected middleware is used.

Remediation

Users of Plack::Middleware::Session::Cookie should update to version 0.22 or later, which includes a warning when the secret option is not set. Version 0.23 TRIAL is also available, which refuses to run without a secret and provides an error message at startup. Additionally, the secret option should be set when using the middleware.