CVE-2021-47157
📋 TL;DR
CVE-2021-47157 is a JSON hijacking vulnerability in the Kossy Perl module that allows attackers to bypass CSRF protections through X-Requested-With header mishandling. This affects web applications using Kossy for JSON responses. Attackers can potentially steal sensitive data from authenticated sessions.
💻 Affected Systems
- Kossy Perl module
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal sensitive JSON data from authenticated users, potentially compromising user accounts, session tokens, or confidential information.
Likely Case
Data exfiltration from JSON API endpoints, leading to privacy violations and potential account compromise.
If Mitigated
Limited impact with proper CSRF tokens and additional security controls in place.
🎯 Exploit Status
Exploitation requires the attacker to trick a user into visiting a malicious site while authenticated to the vulnerable application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.60 and later
Vendor Advisory: https://metacpan.org/dist/Kossy/changes
Restart Required: Yes
Instructions:
1. Update Kossy module to version 0.60 or later using CPAN: cpanm Kossy@0.60
2. Restart your Perl application/web server
3. Verify the update was successful
🔧 Temporary Workarounds
Add custom CSRF protection
allImplement additional CSRF token validation for JSON endpoints
# Add custom middleware or controller logic to validate CSRF tokens for all JSON responses
Disable JSON endpoints temporarily
allRemove or disable JSON API endpoints until patched
# Comment out or remove JSON response routes in your Kossy application
🧯 If You Can't Patch
- Implement strict Content-Type checking for JSON responses
- Add SameSite cookie attributes and additional authentication checks
🔍 How to Verify
Check if Vulnerable:
Check Kossy version: perl -MKossy -e 'print $Kossy::VERSION'Check Version:
perl -MKossy -e 'print "Kossy version: $Kossy::VERSION\n"'Verify Fix Applied:
Verify version is 0.60 or higher and test JSON endpoints with CSRF protection📡 Detection & Monitoring
Log Indicators:
- Unusual JSON requests without proper referrer headers
- Multiple failed CSRF validation attempts
Network Indicators:
- Cross-origin JSON requests with suspicious referrers
- JSON responses to unexpected origins
SIEM Query:
source="web_logs" AND (uri="*.json" OR content_type="application/json") AND referrer NOT IN allowed_domains