The Plack::Middleware::Session library suffers from a predictable session ID vulnerability, which could allow an unauthenticated attacker to hijack active user sessions.

This vulnerability is caused by the use of a cryptographically weak pseudo-random number generator (CWE-338) and predictable inputs, such as epoch time and process IDs, to generate session identifiers. An unauthenticated attacker can leverage this predictability to forge valid session tokens and impersonate legitimate users.

The ability for an attacker to predict session IDs presents a significant risk of unauthorized access to sensitive application data and user accounts. Given the CVSS score of 7.3, this flaw is categorized as High severity, reflecting the potential for complete account takeover without requiring authentication or user interaction. Successful exploitation could lead to widespread data compromise and severe reputational damage.

Immediate Action: Upgrade the Plack::Middleware::Session library to version 0.35 or later immediately to implement a secure session ID generation mechanism.

Proactive Monitoring: Review application logs for unusual session activity, such as multiple successful logins from disparate IP addresses or suspicious patterns in session token generation.

Compensating Controls: While no direct WAF rule can fix the underlying code, ensure that session cookies are flagged with Secure and HttpOnly attributes to limit the exposure of session tokens to network-based attacks.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a critical failure in session security that exposes all users of the affected middleware to potential account compromise. Administrators must prioritize updating to version 0.35 as soon as possible, as there are no effective workarounds to secure the session generation logic without applying the vendor-provided patch.