CVE-2022-4993

Name of the Vulnerable Software and Affected Versions HTML::FormHandler versions prior to 0.40069

Description An issue exists where apply actions and add error use error message text constructed from request data as a Locale::Maketext bracket notation template. Because the default handle's lexicon sets AUTO, strings not found in the lexicon are compiled as templates. In these templates, the first token specifies a method to be called on the language handle, with subsequent tokens serving as arguments.

This can be triggered when a field uses a numeric transform, a type constraint failure occurs, or a validator passes untrusted field values to add error. An attacker can exploit this to cause resource exhaustion by calling CORE::sprintf with an arbitrary field width, leading to excessive memory allocation. Additionally, it can result in unhandled exceptions within the process() function or allow the execution of side-effecting public methods defined in the language handle subclass using attacker-controlled arguments.

Recommendations Update HTML::FormHandler to a version newer than 0.40068. As a temporary mitigation, avoid applying type constraints or transforms to untrusted fields and ensure validators do not pass untrusted field values to the add error function.