CVE-2018-25100

Executive Summary

CVE-2018-25100 is a medium-severity information disclosure vulnerability in the Mojolicious web framework for Perl, specifically within the Mojo::UserAgent::CookieJar module. The flaw allows an attacker to potentially leak cookies in scenarios where multiple similar cookies exist for the same domain. This can lead to unauthorized access to session tokens or other sensitive data stored in cookies. The vulnerability affects all versions of Mojolicious before 7.66. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is elevated due to the widespread use of Mojolicious in Perl-based web applications.

Supply Chain & Package Security

Mojolicious is a Perl-based web framework distributed via CPAN (Comprehensive Perl Archive Network). The vulnerability resides in the core library, meaning any application using an affected version is at risk. Organizations should verify their dependency trees for Mojolicious versions below 7.66 and update immediately. Since Perl modules are often bundled in container images or deployed via package managers, a thorough audit of all environments is required.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (cookie leakage)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS base score is low due to limited impact, the potential for session hijacking or credential theft elevates the risk in real-world scenarios.

Deep Dive & Mechanics

The vulnerability exists in the Mojo::UserAgent::CookieJar module, which manages HTTP cookies for the Mojolicious user agent. When multiple cookies with similar names or attributes are set for the same domain, the cookie jar may incorrectly associate cookies with requests, leading to leakage of cookies intended for a different path or subdomain.

Root Cause: The cookie jar's matching logic fails to properly differentiate between cookies with overlapping domain/path attributes. For example, if a domain sets both session=abc for /app and session=xyz for /, a request to /app might receive both cookies, leaking the more permissive cookie.

Attack Scenario: An attacker who can inject a cookie (e.g., via a cross-site scripting vulnerability or a compromised subdomain) could cause the user agent to send the attacker's cookie along with legitimate cookies, potentially exposing session tokens or authentication data.

Vulnerable vs. Patched Code

Vulnerable Code (Mojolicious < 7.66):

# In Mojo::UserAgent::CookieJar, the cookie matching logic may not properly filter
sub _cookies_for {
    my ($self, $url) = @_;
    my @cookies;
    for my $cookie (@{$self->{cookies}}) {
        # Vulnerable: does not check for similar cookies with different paths
        if ($cookie->domain_matches($url->host) && $cookie->path_matches($url->path)) {
            push @cookies, $cookie;
        }
    }
    return @cookies;
}

Patched Code (Mojolicious 7.66+):

# Patched: adds additional filtering to prevent cookie leakage
sub _cookies_for {
    my ($self, $url) = @_;
    my @cookies;
    for my $cookie (@{$self->{cookies}}) {
        # Now checks for exact path match and prevents similar cookie leakage
        if ($cookie->domain_matches($url->host) && $cookie->path_matches($url->path)) {
            # Additional check: ensure no other cookie with same name but different path is sent
            next if $self->_has_similar_cookie($cookie, $url);
            push @cookies, $cookie;
        }
    }
    return @cookies;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Mojolicious < 7.66
• Ability to set a cookie on the target domain (e.g., via XSS or subdomain takeover)

Exploitation Steps:

1. Identify a target domain using Mojolicious (e.g., via HTTP headers or Shodan dork).
2. Inject a malicious cookie with the same name as a legitimate cookie but with a broader path (e.g., session=attacker_value; path=/).
3. When the victim's user agent makes a request to a restricted path (e.g., /admin), the vulnerable cookie jar may send both the legitimate and malicious cookies.
4. Capture the leaked cookies via server logs or a man-in-the-middle position.

Lab Setup:

# Install vulnerable version
cpan install Mojolicious@7.60

# Create a simple test server
perl -MMojolicious::Lite -e 'app->start' daemon

Blue Team

Detection:

• Monitor for unusual cookie patterns in HTTP requests (e.g., multiple cookies with the same name).
• Use WAF rules to block requests with duplicate cookie names.

Hunting:

• Search logs for requests containing multiple Cookie headers or duplicate cookie names.
• Check for anomalies in session token usage (e.g., sudden changes in session IDs).

Indicators of Compromise (IOCs)

• Network: HTTP requests with multiple Cookie headers for the same cookie name.
• Application: Log entries showing unexpected cookie values or session tokens.
• File System: Presence of Mojolicious versions < 7.66 in Perl module directories.

Detection Engineering

YARA Rule

rule Mojolicious_Cookie_Leak_CVE_2018_25100 {
    meta:
        description = "Detects vulnerable Mojolicious versions in Perl files"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2018-25100"
    strings:
        $vuln_func = "sub _cookies_for"
        $vuln_check = "path_matches"
    condition:
        $vuln_func and $vuln_check and not for any of them : ( # )
}

Sigma Rule

title: Mojolicious Cookie Leak Attempt
id: 8f7c3e2a-1b5d-4f9c-8e7a-6d5c4b3a2f1e
status: experimental
description: Detects HTTP requests with multiple cookies of the same name
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/*'
        cs(Cookie)|contains|all:
            - 'session='
            - 'session='
    condition: selection
falsepositives:
    - Legitimate multi-cookie scenarios (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"Mojolicious Cookie Leak CVE-2018-25100"; flow:to_server; content:"Cookie"; http_header; pcre:"/Cookie:\s*[^;]+=[^;]+;\s*[^;]+=[^;]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Mojolicious to version 7.66 or later.

   cpan upgrade Mojolicious
   

2. Compensating Controls:
   • Implement strict cookie path and domain validation in application code.
   • Use HTTP-only and Secure flags for sensitive cookies.
   • Deploy a Web Application Firewall (WAF) to detect and block duplicate cookie headers.
3. Long-term:
   • Regularly audit Perl module dependencies.
   • Monitor CPAN security advisories for Mojolicious updates.

Valters IT
Securing Digital Frontiers