Plack::App::Prerender versions prior to 0.3.0 contain an SSRF vulnerability due to improper validation of the REQUEST_URI when concatenated with the rewrite base URL. If the rewrite base is a plain string without a path, an attacker can craft a request starting with an '@' character, which modifies the hostname portion of the URL to include arbitrary hosts. For example, a rewrite base of "https://example.com" combined with a request "GET @192.168.1.2/" results in a request to "https://[email protected]/", effectively allowing the attacker to access internal hosts through the proxy functionality of the application.

This vulnerability enables an unauthenticated attacker to perform SSRF attacks, potentially accessing internal or restricted hosts that are otherwise inaccessible externally. The attacker can retrieve content from these internal resources via the vulnerable proxy, leading to confidentiality breaches. The CVSS score of 9.1 reflects high impact on confidentiality and integrity without affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions (<0.3.0) of Plack::App::Prerender or implement strict input validation to ensure that the REQUEST_URI cannot be manipulated to alter the hostname. Monitoring for updates from the vendor or CPAN security advisories is recommended.