Summary
Data::MuForm::Localizer can evaluate Perl expressions found in a message catalog's Plural-Forms header, and its language attribute can influence which catalog file is loaded. If an attacker can control that attribute and provide a suitably placed catalog, the application may execute attacker-controlled code as its own user.
Data::MuForm::Localizer can evaluate Perl expressions found in a message catalog's Plural-Forms header, and its language attribute can influence which catalog file is loaded. If an attacker can control that attribute and provide a suitably placed catalog, the application may execute attacker-controlled code as its own user.
Affected context
The issue affects Perl applications using Data::MuForm::Localizer versions through 0.05 when they load catalogs through load_lexicon. The language value is incorporated into the catalog path without being restricted to a bare locale tag, and catalog header expressions are evaluated as Perl. Risk depends on the application's language-input controls and whether an attacker can place or control a readable .po file at a path that can be reached.
The issue affects Perl applications using Data::MuForm::Localizer versions through 0.05 when they load catalogs through load_lexicon. The language value is incorporated into the catalog path without being restricted to a bare locale tag, and catalog header expressions are evaluated as Perl. Risk depends on the application's language-input controls and whether an attacker can place or control a readable .po file at a path that can be reached.
Exploit preconditions
- Attack surface: Catalog loading through Data::MuForm::Localizer.
- Required access: The attacker must be able to influence the language attribute and make a chosen
.pofile available at a readable path reachable through the constructed catalog filename. - Trigger point: The application loads the selected catalog; code in the plural expression may run during header processing or when a plural message is localized.
- Why exploitation is possible: Path components in the language value are not constrained to a locale name, and Perl expressions from the catalog header are evaluated.
- Attack surface: Catalog loading through Data::MuForm::Localizer.
- Required access: The attacker must be able to influence the language attribute and make a chosen
.pofile available at a readable path reachable through the constructed catalog filename. - Trigger point: The application loads the selected catalog; code in the plural expression may run during header processing or when a plural message is localized.
- Why exploitation is possible: Path components in the language value are not constrained to a locale name, and Perl expressions from the catalog header are evaluated.
Why this happens
Two unsafe behaviors combine. First, load_lexicon uses the language attribute to construct a catalog path without restricting it to a locale identifier, creating a path traversal risk (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). Second, catalog header content is incorporated into Perl code and evaluated, allowing attacker-controlled expressions to execute (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code).
Two unsafe behaviors combine. First, load_lexicon uses the language attribute to construct a catalog path without restricting it to a locale identifier, creating a path traversal risk (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). Second, catalog header content is incorporated into Perl code and evaluated, allowing attacker-controlled expressions to execute (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code).
Potential impact
- Attacker-controlled Perl code may run with the application's privileges.
- The application process or its accessible data and resources could be compromised.
- An attacker may be able to alter or expose data available to the application.
- The issue could provide a foothold for further activity, depending on the runtime environment and permissions.
- Attacker-controlled Perl code may run with the application's privileges.
- The application process or its accessible data and resources could be compromised.
- An attacker may be able to alter or expose data available to the application.
- The issue could provide a foothold for further activity, depending on the runtime environment and permissions.
General mitigation guidance
Defensive patterns include restricting language values to an explicit allowlist of locale identifiers and ensuring resolved catalog paths remain within a designated catalog directory. Avoid evaluating catalog-provided text as code; use a non-executable parser and validate plural rules against a constrained grammar or trusted configuration. Reduce input trust by keeping locale selection separate from request-controlled paths, and limit the application's filesystem access and runtime privileges.
Defensive patterns include restricting language values to an explicit allowlist of locale identifiers and ensuring resolved catalog paths remain within a designated catalog directory. Avoid evaluating catalog-provided text as code; use a non-executable parser and validate plural rules against a constrained grammar or trusted configuration. Reduce input trust by keeping locale selection separate from request-controlled paths, and limit the application's filesystem access and runtime privileges.
How teams detect issues like this
- Use static analysis to identify string-based Perl evaluation and catalog parsing paths that pass file contents into evaluation.
- Review how language values are sourced, validated, and used in filesystem path construction.
- Check that catalog paths are constrained to an approved directory after resolution.
- Apply policy checks that prohibit dynamic evaluation of localization data and require allowlisted locale identifiers.
- Include tests for malformed and unexpected locale values and catalog headers in security reviews.
- Use static analysis to identify string-based Perl evaluation and catalog parsing paths that pass file contents into evaluation.
- Review how language values are sourced, validated, and used in filesystem path construction.
- Check that catalog paths are constrained to an approved directory after resolution.
- Apply policy checks that prohibit dynamic evaluation of localization data and require allowlisted locale identifiers.
- Include tests for malformed and unexpected locale values and catalog headers in security reviews.
