Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler.

The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request for /../outside.txt escapes publicdir, and percent-encoding the dots reaches the same file.

The handler is off by default. An application is affected once it names File in routehandlers and sets statichandler to 0, which otherwise refuses a dot segment before the route runs.

Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above publicdir.

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.

The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard.

The handler is off by default, enabled with autopage. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend.

Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header, or from X-Forwarded-Host under behindproxy (obtained from Dancer2's request->base function). A POST to /login carrying submitreset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls createuser with emailwelcome set.

Through 0.711 the handlers read request->uribase and request->base directly; Versions 0.712 and later provide an uribase configuration key that defaults to the untrusted request->uribase when unset.

The default configuration with resetpasswordhandler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account.

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.

Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.

The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).

These are all low-entropy and easily guessed sources.

The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.

Predictable session ids could allow an attacker to gain access to systems.