CVE-2014-125112
Published: 26 March 2026
Description
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no…
more
secret used to sign the cookie.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely remediation through updating to Plack::Middleware::Session::Cookie version 0.23 or later, which enforces proper cookie signing during deserialization.
Requires cryptographic mechanisms to verify the integrity of software and information such as session cookies, preventing execution of tampered deserialized data lacking a signing secret.
Mandates validation of information inputs like cookies to reject malformed or malicious serialized payloads before deserialization processing on the server.
Security SummaryAI
CVE-2014-125112 is a remote code execution vulnerability in Plack::Middleware::Session::Cookie versions through 0.21 for Perl. The flaw occurs during deserialization of cookie data when no secret is used to sign the cookie, allowing attackers to inject and execute arbitrary code on the affected server. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-565 (Reliance on Cookies without Validation and Integrity Checking).
A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted cookie to a vulnerable application. No user interaction or privileges are required, and exploitation requires low complexity over the network. Successful exploitation grants the attacker full control over the server, enabling high-impact compromise of confidentiality, integrity, and availability through arbitrary code execution.
Advisories and release notes, including a GitHub Gist by the maintainer, changes in Plack::Middleware::Session 0.23-TRIAL on MetaCPAN, and an oss-security mailing list post dated 2026-03-26, detail the issue and mitigation. Practitioners should update to Plack::Middleware::Session::Cookie version 0.23 or later, which addresses the deserialization flaw by enforcing proper signing.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote unauthenticated arbitrary code execution via specially crafted cookies in a public-facing Plack middleware for Perl web applications, directly facilitating T1190: Exploit Public-Facing Application.