CVE-2024-58134: Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default
First published: Sat May 03 2025(Updated: )
Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
Credit: 9b29abf9-4ab0-4765-b253-1875cd9b441e
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mojolicious | >=0.999922<=9.39 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mojolicious/mojo/pull/1791
- https://github.com/mojolicious/mojo/pull/2200
- https://www.synacktiv.com/publications/baking-mojolicious-cookies
- https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802
- https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51
- https://github.com/hashcat/hashcat/pull/4090
Frequently Asked Questions
What is the severity of CVE-2024-58134?
CVE-2024-58134 has a high severity due to its potential to allow an attacker to forge session cookies.
How do I fix CVE-2024-58134?
To fix CVE-2024-58134, update Mojolicious to a version later than 9.39 or change the default HMAC session secret to a more secure, random value.
What versions of Mojolicious are affected by CVE-2024-58134?
CVE-2024-58134 affects Mojolicious versions from 0.999922 through 9.39.
What is the impact of exploiting CVE-2024-58134?
Exploiting CVE-2024-58134 could allow attackers to impersonate users by forging valid session cookies.
Is it safe to use default settings for session secrets in Mojolicious due to CVE-2024-58134?
No, using default settings for session secrets in Mojolicious is not safe due to the predictability of the HMAC session secret.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/last-modified-date
- agent/author
- agent/tags
- agent/event
- vendor/mojolicious
- canonical/mojolicious