{"vulnerability": "CVE-2024-58135", "sightings": [{"uuid": "3a7d2506-80e6-4278-b54e-c28be92ae2a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-58135", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lob5yddgshq2", "content": "", "creation_timestamp": "2025-05-03T12:54:30.814032Z"}, {"uuid": "4276ab28-0f6c-4ec2-9210-dfee4ecdb0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-58135", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lobj437bxg24", "content": "", "creation_timestamp": "2025-05-03T14:05:59.137482Z"}, {"uuid": "bbff8ae9-475e-4315-87fc-c22def0d47e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-58135", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14692", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-58135\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.\n\nWhen creating a default app with the \"mojo generate app\" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.\n\ud83d\udccf Published: 2025-05-03T10:16:10.636Z\n\ud83d\udccf Modified: 2025-05-03T10:16:10.636Z\n\ud83d\udd17 References:\n1. https://perldoc.perl.org/functions/rand\n2. https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181\n3. https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202\n4. https://github.com/mojolicious/mojo/pull/2200\n5. https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220\n6. https://security.metacpan.org/docs/guides/random-data-for-security.html\n7. https://github.com/hashcat/hashcat/pull/4090", "creation_timestamp": "2025-05-03T11:18:52.000000Z"}, {"uuid": "46aca284-7692-4f51-98bb-817e53b60783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-58135", "type": "seen", "source": "https://t.me/cvedetector/24397", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-58135 - Mojolicious Weak HMAC Session Secret Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-58135 \nPublished : May 3, 2025, 11:15 a.m. | 35\u00a0minutes ago \nDescription : Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.  \n  \nWhen creating a default app with the \"mojo generate app\" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-03T14:32:05.000000Z"}]}