CVE-2024-58134

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58134
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean
https://github.com/hashcat/hashcat/pull/4090 Issue Tracking Patch
https://github.com/mojolicious/mojo/pull/1791 Issue Tracking Patch
https://github.com/mojolicious/mojo/pull/2200 Issue Tracking Patch
https://github.com/mojolicious/mojo/pull/2252
https://lists.debian.org/debian-perl/2025/05/msg00016.html
https://lists.debian.org/debian-perl/2025/05/msg00017.html
https://lists.debian.org/debian-perl/2025/05/msg00018.html
https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802 Third Party Advisory
https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51 Product
https://www.synacktiv.com/publications/baking-mojolicious-cookies Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:*
History

20 Oct 2025, 20:15

Type Values Removed Values Added
References
  • () https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean -
  • () https://github.com/mojolicious/mojo/pull/2252 -
  • () https://lists.debian.org/debian-perl/2025/05/msg00016.html -
  • () https://lists.debian.org/debian-perl/2025/05/msg00017.html -
  • () https://lists.debian.org/debian-perl/2025/05/msg00018.html -
Summary (en) Mojolicious versions from 0.999922 through 9.40 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session. (en) Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

17 Jun 2025, 14:15

Type Values Removed Values Added
CPE cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:*
First Time Mojolicious mojolicious
Mojolicious
References () https://github.com/hashcat/hashcat/pull/4090 - () https://github.com/hashcat/hashcat/pull/4090 - Issue Tracking, Patch
References () https://github.com/mojolicious/mojo/pull/1791 - () https://github.com/mojolicious/mojo/pull/1791 - Issue Tracking, Patch
References () https://github.com/mojolicious/mojo/pull/2200 - () https://github.com/mojolicious/mojo/pull/2200 - Issue Tracking, Patch
References () https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802 - () https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802 - Third Party Advisory
References () https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51 - () https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51 - Product
References () https://www.synacktiv.com/publications/baking-mojolicious-cookies - () https://www.synacktiv.com/publications/baking-mojolicious-cookies - Exploit

12 May 2025, 19:15

Type Values Removed Values Added
Summary (en) Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session. (en) Mojolicious versions from 0.999922 through 9.40 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

12 May 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1

05 May 2025, 20:54

Type Values Removed Values Added
Summary
  • (es) Las versiones de Mojolicious de la 0.999922 a la 9.39 para Perl utilizan una cadena de código fijo, o el nombre de la clase de la aplicación, como secreto de sesión HMAC por defecto. Estos secretos predeterminados predecibles pueden explotarse para falsificar cookies de sesión. Un atacante que conozca o adivine el secreto podría calcular firmas HMAC válidas para la cookie de sesión, lo que le permitiría manipular o secuestrar la sesión de otro usuario.

03 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-03 16:15

Updated : 2025-10-20 20:15

NVD link : CVE-2024-58134

Mitre link : CVE-2024-58134

CVE.ORG link : CVE-2024-58134

JSON object : View

Products Affected

mojolicious

  • mojolicious
CWE
CWE-321

Use of Hard-coded Cryptographic Key

CWE-331

Insufficient Entropy