« Volver al listado

CVE-2024-58134

Estado: ModificadaAlta (8.1)—

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.

These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto de red con privilegios (PR:L) permite forjar cookies de sesión HMAC con secreto predecible, posibilitando secuestro de cuentas de usuario (T1078.001) y manipulación de datos de sesión (T1565.003).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationVulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementPassword Policies

Tecnologías afectadas (1)

Mojolicious — Mojolicious

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-58134",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-58134",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-12T15:57:49.444238Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/mojolicious/mojo",
          "vendor": "SRI",
          "product": "Mojolicious",
          "versions": [
            {
              "status": "affected",
              "version": "0.999922",
              "versionType": "custom",
              "lessThanOrEqual": "*"
            }
          ],
          "packageName": "Mojolicious",
          "programFiles": [
            "lib/Mojolicious.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "secrets()"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-03T16:15:19.310",
  "references": [
    {
      "url": "https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/hashcat/hashcat/pull/4090",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/mojolicious/mojo/pull/1791",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/mojolicious/mojo/pull/2200",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/mojolicious/mojo/pull/2252",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51",
      "tags": [
        "Product"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://www.synacktiv.com/publications/baking-mojolicious-cookies",
      "tags": [
        "Exploit"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        },
        {
          "lang": "en",
          "value": "CWE-331"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.\n\nThese predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session."
    },
    {
      "lang": "es",
      "value": "Las versiones de Mojolicious de la 0.999922 a la 9.39 para Perl utilizan una cadena de código fijo, o el nombre de la clase de la aplicación, como secreto de sesión HMAC por defecto. Estos secretos predeterminados predecibles pueden explotarse para falsificar cookies de sesión. Un atacante que conozca o adivine el secreto podría calcular firmas HMAC válidas para la cookie de sesión, lo que le permitiría manipular o secuestrar la sesión de otro usuario."
    }
  ],
  "lastModified": "2026-06-17T08:14:41.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "007066BB-83B9-4F4C-BAAB-261837197373",
              "versionEndIncluding": "9.40",
              "versionStartIncluding": "0.999922"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}