PT-2025-18947 · Unknown+1 · Mojolicious+1

Antoine Cervoise + 2 · Published 2025-05-03 · Updated 2025-10-20 · CVE-2024-58134

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mojolicious versions 0.999922 through 9.39

Description The issue concerns the use of a hard-coded string or the application's class name as a HMAC session secret by default in Mojolicious for Perl. This predictable default secret can be exploited to forge session cookies, allowing an attacker to tamper with or hijack another user's session if they know or guess the secret.

Recommendations For Mojolicious versions 0.999922 through 9.39, consider changing the default HMAC session secret to a unique, randomly generated value to prevent session cookie forgery. As a temporary workaround, restrict access to sensitive user sessions until a secure secret can be implemented.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-331

Related Identifiers

AZL-61673

AZL-61825

CVE-2024-58134

Affected Products

Debian

Mojolicious

References · 27

• 🔥 https://github.com/hashcat/hashcat/pull/4090 · Exploit
• 🔥 https://synacktiv.com/publications/baking-mojolicious-cookies · Exploit
• https://github.com/mojolicious/mojo/pull/2200 · Patch
• https://github.com/mojolicious/mojo/pull/1791 · Patch
• https://osv.dev/vulnerability/AZL-61825 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58134 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-58134 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-58134 · Security Note
• https://osv.dev/vulnerability/CVE-2024-58134 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-58134 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-58134 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61673 · Vendor Advisory
• https://github.com/mojolicious/mojo/pull/2252 · Note
• https://t.me/cvetracker/22992 · Telegram Post