Catalyst::Plugin::Statsd Session ID Leakage Vulnerability

A vulnerability exists in Catalyst::Plugin::Statsd for Perl, affecting versions prior to 0.10.0, where session IDs may be leaked over unsecured communication channels to the statsd daemon. This leakage could allow an attacker to use the session IDs as authentication tokens. The issue arises if UDP packets are sent to a host on another network without proper security measures.

Impact

Exploitation of this vulnerability could lead to unauthorized access using leaked session IDs as authentication tokens.

Remediation

Users are advised to upgrade to Catalyst::Plugin::Statsd version 0.10.0 or later, which no longer logs session IDs to statsd. If Plack::Middleware::Statsd is upgraded to version 0.9.0 or later and configured to log information securely, session IDs will be logged as HMAC signatures instead. Alternatively, a statsd daemon can be used on the same host or through a secure communications channel.