CVE-2023-52431 is a high severity (8.8) bypass of the CSRF protection in the Perl module Plack::Middleware::XSRFBlock before 0.0.19. An empty form value together with an empty cookie passes the check when signed cookies are disabled. Upgrade to 0.0.19 or later.
What's affected
NVD lists Plack::Middleware::XSRFBlock before 0.0.19, so 0.0.19 is the fixed version in the record. The record points to the CPAN security advisory entry and the release Changes file for 0.0.19. The Changes page returned nothing when I fetched it, so I could not read the maintainer's own notes.
The bypass applies, per the description, if signed cookies are disabled. That configuration is the condition to check first.
Weakness classes: CWE-269 and CWE-352.
This is a middleware for Perl PSGI applications such as Dancer2 and Mojolicious deployments that use Plack, so it often sits inside a larger framework stack.
How to check if you're exposed
Read the installed version.
perl -MPlack::Middleware::XSRFBlock -e 'print $Plack::Middleware::XSRFBlock::VERSION, "\n"'
Or list it through cpanm.
cpanm --info Plack::Middleware::XSRFBlock
carton list | grep XSRFBlock
Then check how the middleware is configured in your app. Look for the signed cookies option and see whether it is off.
What to do now
- Upgrade Plack::Middleware::XSRFBlock to 0.0.19 or later and redeploy.
- Update your cpanfile and snapshot so the old version does not return.
- Review whether signed cookies are enabled in your configuration, since the description ties the bypass to them being off.
- Test that a form post with an empty token is rejected after the upgrade.
Why it matters
Cross site request forgery protection works by comparing a secret in the form with a secret in the cookie. If the check treats two empty values as a match, it passes when the attacker sends neither, and the attacker no longer needs to know the secret. That is the logic gap described here.
A working bypass lets a hostile page cause a signed in user's browser to submit state changing requests. NVD scores it 8.8 with a network vector and user interaction required. The record shows it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Version 0.0.19, according to the NVD record. Check the module Changes file for the maintainer's notes.
Do signed cookies protect me?
The description says the bypass works if signed cookies are disabled, so enabling them may reduce exposure. Upgrading is still the fix.
Sources
Last reviewed: 19 October 2026.
