PT-2025-18941 · Unknown+1 · Mojolicious+1

Published 2025-05-03 · Updated 2025-10-20 · CVE-2024-58135

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mojolicious versions 7.28 through 9.39

Description The issue concerns the generation of weak HMAC session secrets in Mojolicious for Perl. When creating a default app, a weak secret is written to the application's configuration file using the insecure rand() function. This secret is used for authenticating and protecting the integrity of the application's sessions, potentially allowing an attacker to brute force the application's session keys.

Recommendations For Mojolicious versions 7.28 through 9.39, consider regenerating the session secrets with a secure random number generator to mitigate the risk of brute force attacks. As a temporary workaround, restrict access to sensitive areas of the application that rely on session authentication until a secure secret can be generated.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

AZL-61741

AZL-61822

CVE-2024-58135

Affected Products

Debian

Mojolicious

References · 26

• 🔥 https://github.com/hashcat/hashcat/pull/4090 · Exploit
• https://github.com/mojolicious/mojo/pull/2200 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-58135 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-58135 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-58135 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58135 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-58135 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58135 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-58135 · Security Note
• https://osv.dev/vulnerability/AZL-61822 · Vendor Advisory
• https://t.me/cvenotify/120723 · Telegram Post
• https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181 · Note
• https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202 · Note
• https://t.me/cvetracker/22986 · Telegram Post