Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via     mojo generate app by default. When creating a default app skeleton with the mojo generate app tool, a     weak secret is written to the application's configuration file using the insecure rand() function, and     used for authenticating and protecting the integrity of the application's sessions. This may allow an     attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high     quality randomness, even in absence of CryptX. Users should be aware that the update does not replace     previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure     the updated version is using a strong secret. (CVE-2024-58135)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-985 advisory.

    Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's     class name, as a HMAC session secret by default.

    These predictable default secrets can be exploited to forge session cookies. An attacker who knows or     guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper     with or hijack another user's session. (CVE-2024-58134)

    Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.

    When creating a default app with the mojo generate app tool, a weak secret is written to the     application's configuration file using the insecure rand() function, and used for authenticating and     protecting the integrity of the application's sessions. This may allow an attacker to brute force the     application's session keys.++6330 (CVE-2024-58135)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
257977	Linux Distros Unpatched Vulnerability : CVE-2024-58135	Nessus	Misc.	Local	medium
237678	Amazon Linux 2023 : perl-Mojolicious, perl-Test-Mojo (ALAS2023-2025-985)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2024-58135

medium

Tenable Plugins

medium

high