CyberRota Analysis
AI-GeneratedVersions of Punk prior to 0.18 for Perl are vulnerable to session cookie forgery due to the use of an empty default HMAC key when sessions are declared without a secret. This flaw allows attackers to create malicious cookies that can impersonate users by carrying sensitive information, such as user identifiers or roles, without detection. Organizations using affected versions should prioritize remediation to protect against potential unauthorized access and session hijacking.
Original NVD Description
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.