CVE-2024-58134: Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58134?
CVE-2024-58134 has a high severity due to its potential to allow an attacker to forge session cookies.
How do I fix CVE-2024-58134?
To fix CVE-2024-58134, update Mojolicious to a version later than 9.39 or change the default HMAC session secret to a more secure, random value.
What versions of Mojolicious are affected by CVE-2024-58134?
CVE-2024-58134 affects Mojolicious versions from 0.999922 through 9.39.
What is the impact of exploiting CVE-2024-58134?
Exploiting CVE-2024-58134 could allow attackers to impersonate users by forging valid session cookies.
Is it safe to use default settings for session secrets in Mojolicious due to CVE-2024-58134?
No, using default settings for session secrets in Mojolicious is not safe due to the predictability of the HMAC session secret.