CVE-2024-58135

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.

• CWE-338
• CWE-338

• https://github.com/hashcat/hashcat/pull/4090Issue Tracking, Patch
• https://github.com/mojolicious/mojo/commit/789cfa43f9118852b38cbd1fd0a2596bcb9821ea.patch
• https://github.com/mojolicious/mojo/commit/fb3733f92cc8a3344e6d615b3c7dac9d538eeab0.patch
• https://github.com/mojolicious/mojo/pull/2200Exploit, Issue Tracking, Patch
• https://lists.debian.org/debian-perl/2025/05/msg00016.html
• https://lists.debian.org/debian-perl/2025/05/msg00017.html
• https://lists.debian.org/debian-perl/2025/05/msg00018.html
• https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220Product
• https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202Product
• https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181Product
• https://metacpan.org/release/SRI/Mojolicious-9.46/source/Changes
• https://perldoc.perl.org/functions/randProduct
• https://security.metacpan.org/docs/guides/random-data-for-security.htmlTechnical Description

Published

May 3, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5813A medium severity vulnerability in BIPS has been identified …4.9
• CVE-2024-58130In app/Controller/Component/RestResponseComponent.php in MIS…6.1
• CVE-2024-58131FISCO BCOS 3.11.0 has an issue with synchronization of the t…3.7
• CVE-2024-58132In chainmaker-go (aka ChainMaker) before 2.3.6, multiple upd…4
• CVE-2024-58133In chainmaker-go (aka ChainMaker) before 2.4.0, when making …4
• CVE-2024-58134Mojolicious versions from 0.999922 for Perl uses a hard code…8.1
• CVE-2024-58136Yii 2 before 2.0.52 mishandles the attaching of behavior tha…9.8
• CVE-2024-5814A malicious TLS1.2 server can force a TLS1.3 client with dow…5.3
• CVE-2024-5815A Cross-Site Request Forgery vulnerability in GitHub Enterpr…6.5
• CVE-2024-5816An Incorrect Authorization vulnerability was identified in G…5.3
• CVE-2024-5817An Incorrect Authorization vulnerability was identified in G…6.5
• CVE-2024-5818The Royal Elementor Addons and Templates plugin for WordPres…5.4