Description

Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.

When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

Classification

CVE ID: CVE-2024-58135

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor: SRI

Product: Mojolicious

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 13.61% (scored less or equal to compared to others)

EPSS Date: 2025-06-01 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-58135
https://perldoc.perl.org/functions/rand
https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181
https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202
https://github.com/mojolicious/mojo/pull/2200
https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220
https://security.metacpan.org/docs/guides/random-data-for-security.html
https://github.com/hashcat/hashcat/pull/4090

Timeline