CGI versions prior to 5.00 for Perl contain an infinite loop vulnerability triggered by a short request body when $DISABLE_UPLOADS is set. This occurs because the server reads until the declared Content-Length is reached, but if the actual body is shorter, the read returns zero repeatedly, causing the server process to hang indefinitely. This can be exploited by a client to keep a server process busy, potentially leading to denial of service.
CGI versions prior to 5.00 for Perl have a vulnerability that allows resource exhaustion due to lack of limits on request size, parameters, and uploads. The default setting for $CGI::POST_MAX imposes no limit, and certain multipart body types bypass enforcement. This can lead to memory, CPU, and disk exhaustion.
A cross-site scripting (XSS) vulnerability exists in CGI for Perl versions before 5.00. The flaw arises because arguments are inserted between HTML comment tags without proper escaping, allowing text containing the sequence '-->' to prematurely close the comment and inject arbitrary HTML. This can lead to HTML injection in applications that pass request data into comments.
CGI versions prior to 5.00 for Perl contain a vulnerability where unescaped double quotes in the Content-Disposition header's attachment filename parameter allow injection of a second filename parameter. This occurs because the header function writes the attachment name directly into the quoted filename parameter without escaping double quotes, potentially altering the filename under which a response is saved.
A type confusion vulnerability exists in CGI versions 4.71 up to but not including 5.00 for Perl. The issue arises because the uploadInfo function dereferences its argument and calls its filename method without verifying that the argument is an upload filehandle. This allows a plain string referencing a global variable to be treated as a symbolic reference, causing the method call to fail and resulting in a denial of service.
CGI versions prior to 5.00 for Perl contain a vulnerability in the scrolling_list feature where submitted values are used unescaped in regular expressions for option group selection. This can lead to denial of service by causing the process to crash with invalid patterns or become unresponsive due to excessive regex backtracking.
CGI::Cookie versions before 5.00 for Perl have a vulnerability where cookie attribute injection is possible via unvalidated path, domain, and expires values. These values are written into the Set-Cookie header without validation for semicolons or control characters, allowing an attacker to inject additional cookie attributes such as Domain or SameSite if the application sets these values from request data.
A cross-site scripting (XSS) vulnerability exists in CGI versions from 4.62 up to but not including 5.00 for Perl. The flaw arises because the URL returned by the url and self_url methods can contain a raw apostrophe due to how URI's canonical method processes it. This raw apostrophe can appear in single-quoted HTML attributes or JavaScript strings, enabling XSS attacks. The issue is fixed in version 5.00.
CGI versions prior to 5.00 for Perl improperly return certain request-derived values as untainted under Perl's taint mode. This includes upload filenames, uploadInfo values, some path_info and script_name values, Accept headers, name lists from url_param and cookie, and a cookie named expires from version 4.67 onward. These values originate from regex captures or hash keys, which Perl does not mark as tainted, allowing them to bypass -T taint checks without validation.
CGI versions prior to 5.00 for Perl have a path traversal vulnerability where uploaded filenames are returned with any client-supplied path, including directory traversal sequences like ../ and Windows paths. This allows an attacker to cause the application to write files outside the intended directory if it saves uploads using the provided filename parameter without validation.
CGI versions prior to 5.00 for Perl contain a cross-site request forgery (CSRF) vulnerability. The software allows certain parameters (POSTDATA, PUTDATA, PATCHDATA, and XForms:Model) to be set from query strings or form fields, which can be exploited by a malicious cross-site HTML form to send forged requests. This occurs because CGI cannot distinguish between client-sent values and the actual request body, enabling unauthorized actions without requiring CORS preflight checks.
CGI versions prior to 5.00 for Perl contain an HTTP request splitting vulnerability due to improper handling of HTTP header values. The vulnerability arises from entity decoding after newline checks and lack of validation in multipart_start and do_push functions, allowing injection of encoded carriage return or line feed characters into HTTP headers. This can enable an attacker to add headers or split the HTTP response when request data is passed into these header values.
CGI versions prior to 5.00 for Perl contain an open redirect vulnerability due to improper ordering of validation and canonicalization. The redirect function decodes HTML entities in the URL after validation, allowing a validated URL to be transformed into a different URL that can redirect users to an unintended external host.
CGI versions prior to 5.00 for Perl contain active debug code that is triggered when an unrecognized REQUEST_METHOD is received. Specifically, for methods like OPTIONS, the software enters an offline debugging mode by default, using command line arguments to build parameters and path_info, which could lead to unintended behavior.
CGI versions prior to 5.00 for Perl contain an open redirect and script injection vulnerability due to unsafe construction of URLs from the client-supplied REQUEST_URI. This allows attackers to craft URLs that redirect users to malicious sites or execute scripts via protocol-relative, absolute, or javascript: URLs.
A vulnerability in CGI versions prior to 5.00 for Perl allows form fields to be smuggled past proxies and web application firewalls due to multipart parsing that deviates from RFC standards. This includes matching boundaries anywhere instead of at line starts, improper handling of boundaries for certain User-Agent values, and corruption of parts near the 4096-byte read size limit.
CGI::Carp versions prior to 5.00 for Perl contain a vulnerability where warnings generated in one user's request can leak into the HTML response of another user's request in persistent environments such as mod_perl, FastCGI, or PSGI. This occurs because a package-level buffer holding warnings is not cleared between requests, causing exposure of data elements across sessions.
CGI versions prior to 5.00 for Perl improperly trust the client-supplied X-Forwarded-Host header when constructing URLs and redirects. This lack of validation allows an attacker to manipulate URLs used in redirects, links, and scripts, potentially poisoning shared caches and causing users to be redirected to malicious hosts.
A vulnerability in CGI versions before 5.00 for Perl allows CPU exhaustion through inefficient regular expression processing. The flaw arises when handling POST requests with a multipart/related Content-Type, where an unanchored regex pattern causes excessive backtracking on malformed headers. This can lead to denial of service without requiring a request body.
A denial of service vulnerability exists in CGI::Cookie versions from 4.67 up to but not including 5.00 for Perl. The issue arises because the expires value from a client cookie is used unescaped in a regular expression within the parse method, allowing crafted input to cause catastrophic backtracking or invalid regex patterns that crash the process. This flaw was fixed in version 5.00.