The Punk web framework for Perl contains a critical session management vulnerability that allows unauthenticated attackers to forge session cookies and hijack user identities.

The vulnerability stems from the framework defaulting to a zero-length HMAC-SHA256 key when no secret is defined for session management. This allows an unauthenticated attacker who understands the cookie format to craft valid session tokens offline, effectively granting them the ability to impersonate any user or administrative role.

Successful exploitation of this flaw allows attackers to achieve total compromise of user sessions, leading to unauthorized access to sensitive data, administrative functions, and account takeover. Given the CVSS score of 9.1, this vulnerability represents a critical risk to application integrity and data confidentiality. The inability of the framework to warn users about missing secrets significantly increases the likelihood of misconfiguration in production environments.

Immediate Action: Update the Punk framework to version 0.18 or later immediately to enforce proper HMAC key generation.

Proactive Monitoring: Review application logs for anomalous session activity, such as unexpected changes in user roles or session identifiers that do not correlate with legitimate login events.

Compensating Controls: Ensure that all deployments of the Punk framework are configured with a strong, cryptographically secure secret key, even if the application is currently being updated.

Public Exploit Available: Unknown

This vulnerability is critical and requires immediate attention to prevent unauthorized access. Administrators must verify their current version of the Punk framework and apply the update to 0.18 without delay. Furthermore, security teams should conduct an audit of all applications utilizing this framework to ensure that a robust session secret is explicitly defined in the configuration.