Weak HMAC Session Secrets in Mojolicious for Perl
CVE-2024-58135
5.3MEDIUM
What is CVE-2024-58135?
Mojolicious versions from 7.28 to 9.39 for Perl have a security flaw related to the generation of HMAC session secrets. When applications are created using the 'mojo generate app' tool, it generates a weak secret based on the insecure rand() function, which is retained in the application's configuration file. This flaw compromises the authentication and integrity of the application's sessions, making them susceptible to brute-force attacks that could allow unauthorized access.
Affected Version(s)
Mojolicious 7.28 <= 9.45
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.