CVE-2015-10149: 
Linux Debian Analyse et atténuation de la vulnérabilité

CVE-2015-10149 is a path traversal and injection vulnerability in the Dancer web framework for Perl, affecting all versions before 1.3400. The flaw exists in the read_session_id function within Dancer::Session::Abstract, which returns the session cookie value as the session ID without validating its characters, passing it directly to the session engine. A remote, unauthenticated attacker can craft a malicious session cookie to trigger path traversal or injection in session engines that use the ID in file paths, cache commands, or database queries. The CVSS category is estimated as HIGH (Feedly, GitHub Advisory).

The root cause is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input), with an additional estimate of CWE-22 (Path Traversal). The vulnerable code in lib/Dancer/Session/Abstract.pm returns the raw cookie value from read_session_id without any character validation, allowing values such as ../../../etc/passwd to be passed directly to session storage backends (e.g., Dancer::Session::YAML, Dancer::Session::JSON, Dancer::Session::Storable) that use the session ID as a file path or query parameter. The fix, introduced in PR #1172 and merged March 20, 2018, added a validate_session_id method that enforces a whitelist regex (^[A-Za-z0-9_\-~]+$) before the ID is used (GitHub Commit, GitHub PR #1172).

Successful exploitation allows an unauthenticated remote attacker to manipulate the session cookie to inject path traversal sequences or malicious characters, potentially enabling unauthorized access to arbitrary session files on the server's filesystem, injection into cache commands, or malicious query injection depending on the session engine in use. The impact varies by session backend: file-based engines (YAML, JSON, Storable) are susceptible to directory traversal allowing reading or overwriting arbitrary files accessible to the web server process, while cache or database-backed engines may be vulnerable to injection attacks. This could lead to session hijacking, sensitive data disclosure, or further system compromise (Feedly, GitHub Issue #1118).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify web applications built with the Dancer Perl framework (versions before 1.3400) by examining HTTP response headers (e.g., X-Powered-By: Perl/Dancer) or application fingerprinting.
2. Identify session cookie: Interact with the target application to obtain a valid session cookie (e.g., dancer.session=<id>), observing the cookie name used by the session engine.
3. Craft malicious session ID: Replace the session cookie value with a path traversal payload such as ../../../etc/passwd (for file-based session engines like YAML or Storable) or an injection string appropriate for the backend in use.
4. Send crafted request: Submit an HTTP request to the application with the manipulated session cookie. The unvalidated ID is passed directly to the session engine's retrieve() method.
5. Achieve objective: Depending on the session engine, the server may attempt to open or read the file at the traversed path, expose its contents in an error message or response, or execute an injected cache/database command (GitHub Issue #1118, GitHub Commit).

• Network: HTTP requests containing session cookies with path traversal sequences (e.g., ../, %2e%2e%2f) or unusual characters (e.g., /, \, %00) in the session cookie value field.
• Logs: Web server access logs showing requests where the session cookie value contains directory traversal patterns; application error logs showing warnings such as "Rejecting invalid session ID" (present only after patching) or file-not-found errors for unexpected file paths.
• File System: Unexpected file access attempts in session storage directories (e.g., Dancer session file directories) for files outside the expected session storage path; access to sensitive system files (e.g., /etc/passwd) by the web server process.
• Process: Unusual file open operations by the Perl/Dancer web server process targeting paths outside the application's session directory.

Upgrade Dancer to version 1.3400 or later, which introduces the validate_session_id method that enforces a strict character whitelist (^[A-Za-z0-9_\-~]+$) on session IDs before they are passed to the session engine (GitHub PR #1172, MetaCPAN Changelog). As a temporary workaround for those unable to upgrade immediately, implement input validation on session IDs within each session engine's retrieve() method to reject IDs containing path traversal characters or other unsafe sequences. Applications using Dancer::Session::Cookie are less directly affected as that engine stores session contents (not a simple ID) in the cookie, but upgrading remains the recommended action.

The vulnerability was discussed in the Dancer GitHub repository as early as June 2015 (PR #1117), where contributor yanick initially proposed checking session IDs upon retrieval. The fix was reverted and reworked multiple times due to compatibility concerns with Dancer::Session::Cookie, with maintainer bigpresh noting the issue as a "hideous problem that should have been fixed long ago" (GitHub Issue #1118). The final fix was merged in March 2018 and formally assigned a CVE identifier in November 2026. Social media activity was limited to automated CVE notification accounts on Bluesky.