CVE-2024-58135: Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets
First published: Sat May 03 2025(Updated: )
Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
Credit: 9b29abf9-4ab0-4765-b253-1875cd9b441e
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mojolicious | >=7.28<=9.39 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://perldoc.perl.org/functions/rand
- https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181
- https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202
- https://github.com/mojolicious/mojo/pull/2200
- https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://github.com/hashcat/hashcat/pull/4090
Frequently Asked Questions
What is the severity of CVE-2024-58135?
CVE-2024-58135 is considered a high severity vulnerability due to weak HMAC session secrets being generated.
How do I fix CVE-2024-58135?
To fix CVE-2024-58135, update your Mojolicious version to 9.40 or higher to ensure secure HMAC session secrets are used.
What versions are affected by CVE-2024-58135?
CVE-2024-58135 affects Mojolicious versions from 7.28 to 9.39 inclusive.
What is the main issue with CVE-2024-58135?
The main issue with CVE-2024-58135 is the generation of weak HMAC session secrets using the insecure rand() function.
How can weak HMAC secrets in CVE-2024-58135 impact my application?
Weak HMAC secrets may allow attackers to forge authentication tokens, potentially leading to unauthorized access.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/mojolicious
- canonical/mojolicious