Description (CNA)
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SRI / Mojolicious | affected 4.59 before 9.48 |
CWE
CWE-204, CWE-352
References
- https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch
- https://metacpan.org/release/SRI/Mojolicious-9.48/changes
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.