SRI Mojolicious up to 9.39 on Perl HMAC Session Secrets rand weak prng

Summaryinfo

A vulnerability, which was classified as problematic, has been found in SRI Mojolicious up to 9.39 on Perl. This vulnerability affects the function rand of the component HMAC Session Secrets Handler. The manipulation leads to weak prng. This vulnerability is listed as CVE-2024-58135. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SRI Mojolicious up to 9.39 on Perl. This issue affects the function rand of the component HMAC Session Secrets Handler. The manipulation with an unknown input leads to a weak prng vulnerability. Using CWE to declare the problem leads to CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. Impacted is confidentiality. The summary by CVE is:

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.

It is possible to read the advisory at perldoc.perl.org. The identification of this vulnerability is CVE-2024-58135 since 04/07/2025. The exploitation is known to be difficult. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 237678 (Amazon Linux 2023 : perl-Mojolicious, perl-Test-Mojo (ALAS2023-2025-985)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (237678) and EUVD (EUVD-2025-13365). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• SRI

Name

• Mojolicious

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18
• 9.19
• 9.20
• 9.21
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.27
• 9.28
• 9.29
• 9.30
• 9.31
• 9.32
• 9.33
• 9.34
• 9.35
• 9.36
• 9.37
• 9.38
• 9.39

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion