Plack Middleware Security Common Header Injection Vulnerability

A vulnerability exists in Plack::Middleware::Security::Common for Perl, affecting versions prior to 0.13.1. The issue allows header injections in request paths to bypass security measures, unless the injections are double-encoded. For instance, a request path could be crafted to include CRLF sequences followed by additional headers, potentially evading detection by reverse proxies or Plack-based servers.

Impact

Exploitation of this vulnerability could lead to header injection attacks, allowing attackers to manipulate HTTP headers in requests, which could be exploited by the application or server processing the request.

Remediation

Users can upgrade to Plack::Middleware::Security::Common version 0.13.1 or later, where this vulnerability has been fixed.