Weak HMAC Session Secrets in Mojolicious - CVE-2024-58135
Summary
CVE-2024-58135: Mojolicious versions from 7.28 through 9.40 for Perl may generate weak HMAC session secrets. Affects libmojolicious-perl versions >= 466b3bb90fbd055410771ea09f0506b2f26faf2f, <= 1a87f721d24a4542ac7828753696e9462f790ab6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mojolicious is a real-time web framework for Perl that simplifies the development of web applications. It provides a rich set of features, including a powerful routing system, support for WebSockets, and a built-in testing framework. The framework is widely used for building modern web applications. However, versions from 7.28 through 9.39 are vulnerable to a security issue that compromises session integrity.
Vulnerability Detail
The vulnerability arises from the use of the insecure rand() function to generate HMAC session secrets when creating a default application with the 'mojo generate app' tool. This weak secret can be exploited by attackers to brute force session keys, potentially allowing unauthorized access to user sessions and sensitive data. The flaw affects all applications generated with vulnerable versions of Mojolicious, making it critical for developers to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, update the Mojolicious package to a patched version. You can do this by running the following command in your terminal:
sudo apt-get update && sudo apt-get install libmojolicious-perl
Ensure that you are using a version higher than 9.39, which contains the necessary security fixes.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually set a strong, random secret in their application's configuration file instead of relying on the default generated by Mojolicious. For example, you can generate a secure secret using Perl's Crypt::Random module and set it in your app's config: 'my $secret = Crypt::Random::
makerandom(size => 32);
'.
Conclusion
The CVE-2024-58135 vulnerability in Mojolicious poses a significant risk due to weak HMAC session secrets generated by default. It is crucial for developers to update their packages to the latest versions to ensure the security of their applications. Implementing a strong custom secret can serve as a temporary measure until the update is applied.
See every vulnerability recorded for libmojolicious-perl →
FAQ
CVE-2024-58135 is a vulnerability in Mojolicious that allows weak HMAC session secrets to be generated, potentially leading to session hijacking.
Mojolicious versions from 7.28 through 9.39 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary risk is that attackers can brute force session keys, leading to unauthorized access to user sessions and sensitive information.
If immediate updates are not possible, implement a strong custom secret as a workaround to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for libmojolicious-perl.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.