A vulnerability in the Dancer2 web framework allows unauthenticated attackers to bypass security hooks, posing a high risk to application integrity.

This vulnerability involves improper cleanup on thrown exceptions, where a dying hook fails to properly halt the request dispatcher. An unauthenticated attacker can trigger this condition to ensure that restricted route bodies are executed despite a refusal from a before hook.

The ability to bypass security checks and execute restricted routes can lead to unauthorized access to sensitive application functionality and data modification. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to the application logic and overall system security posture.

Immediate Action: Upgrade the Dancer2 package to version 2.2.0 or later immediately to incorporate the necessary fix for exception handling.

Proactive Monitoring: Monitor application logs for unexpected access to restricted administrative routes or anomalous request patterns following route dispatch failures.

Compensating Controls: Implement strict access control checks at the application level to ensure that route execution remains protected, even if the framework hook logic fails.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to the integrity of PerlDancer web applications by allowing unauthorized access to restricted routes. Administrators should prioritize updating to Dancer2 version 2.2.0 across all environments to ensure that security hooks are properly enforced and request lifecycles are correctly managed.