CVE-2026-77568

Executive Summary

CVE-2026-77568 is a cross-site request forgery (CSRF) token disclosure vulnerability in the Perl real-time web framework Mojolicious, affecting versions prior to 9.48. The flaw arises because the CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML; when response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker can exploit a BREACH compression side channel to recover the token by inducing many victim requests and observing response sizes. Successful token recovery enables the attacker to forge cross-site requests on behalf of the victim. The issue is fixed in version 9.48.

Technical Analysis

Mojolicious is a real-time web framework for Perl. This vulnerability is a classic instance of the BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) attack class, combined with a CSRF token design weakness.

Two conditions must simultaneously hold for exploitation:

1. Static per-session CSRF token in compressed output. The helpers csrf_field, csrf_token, and csrf_protect render a token that remains unchanged for the lifetime of the session. Because the token is embedded in HTML output, and that HTML is compressed when response compression is enabled, the token becomes subject to compression-oracle analysis. The NVD description explicitly states the token "reuse[s] an unchanged per-session token in rendered HTML."

2. Attacker-influenced content reflected in the same response. The BREACH technique works by injecting attacker-controlled strings into a compressed response that also contains the secret. When the guessed prefix of the secret matches the injected string, the compression algorithm produces a shorter output, which is observable as a reduced response size. The NVD description confirms this precondition: "attacker-influenced content is reflected in the same response."

The attack surface is any Mojolicious application that (a) enables response compression, (b) renders the CSRF token into HTML, and (c) reflects user-controllable input into the same response body. The NVD description notes that "API-only deployments that never render the token in HTML are not affected," which sharply narrows the exposure to browser-facing, HTML-rendering applications.

The vulnerability is mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (base score 4.2), reflecting network exploitability, high attack complexity (the compression oracle requires many adaptive requests), no privileges required, required user interaction, unchanged scope, and low confidentiality and integrity impact. Availability impact is none.

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is inferred from the BREACH vulnerability class and the mechanics described in the NVD entry. No function names, endpoints, or parameters beyond those in the NVD description are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The following sequence is the canonical BREACH-style exploitation pattern adapted to this CVE. All named helpers (csrf_field, csrf_token, csrf_protect) are those stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Mojolicious-backed, browser-facing application that renders a CSRF token into HTML and has HTTP response compression enabled. The attacker also identifies at least one request parameter whose value is reflected into the same compressed response body (the "reflection point" precondition). API-only deployments rendering no token in HTML are explicitly excluded.

2. Triggering the flaw class. The attacker causes the victim's browser to issue a large number of requests to the reflecting endpoint, each carrying a carefully crafted guess in the reflected parameter. Because the CSRF token is static for the session and is present in the same compressed response, the compression ratio of the response depends on how closely the attacker's guess matches the token. The attacker (or a script observing cross-origin timing/size side channels) measures the resulting response sizes.

3. Payload / execution method (vulnerability-class level). This is an adaptive chosen-plaintext attack. By iteratively extending a guessed prefix of the token and observing which guess minimizes compressed response size, the attacker recovers the token one character at a time. No code injection is involved; the "payload" is the set of candidate strings injected into the reflected parameter and the measurement harness that infers the token from response-size deltas.

4. Post-exploitation impact. With the recovered per-session CSRF token, the attacker forges cross-site requests that the victim's browser submits with the victim's session credentials. The framework's CSRF protection is defeated because the token is now known. The result is unauthorized state-changing actions under the victim's identity (integrity impact = Low per CVSS), with limited confidentiality impact.

Impact Assessment

Business impact is scoped but real. Per CVSS v3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N):

• Confidentiality (Low): the recovered secret is the CSRF token itself; it does not directly expose arbitrary application data, but it may be reused within the forged-request flow.
• Integrity (Low): the attacker can forge cross-site requests, potentially performing state-changing actions as the victim.
• Availability (None).
• Attack Complexity (High): a BREACH oracle requires a large number of adaptively chosen requests and reliable observation of response sizes; mitigations such as per-request token randomization or disabling compression on reflecting pages break the attack.
• Privileges Required (None), User Interaction (Required): the victim must be induced to load attacker-crafted content that generates the probing requests.

Blast radius: only HTML-rendering Mojolicious applications with response compression enabled and reflected attacker input. API-only deployments are unaffected. The base score of 4.2 reflects the tight precondition set and high attack complexity rather than a diminished end impact once those preconditions are met.

Detection Guidance

Sigma Rule

title: Possible BREACH-Style CSRF Token Extraction Against Mojolicious
id: 7f3c1a2e-4b6d-4c9a-9e21-5b0a1f2c8d77
status: experimental
description: Detects high-volume, repetitive requests to a single endpoint with rapidly changing query values, consistent with a BREACH compression side-channel oracle against Mojolicious CSRF tokens.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77568
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: GET
  selection_compression:
    sc-status: 200
  timeframe: 5m
  condition: selection_method and selection_compression | count() by src_ip, c-uri > 150
falsepositives:
  - Legitimate high-rate polling clients
  - Load-testing or fuzzing tools in non-production environments
level: medium
tags:
  - attack.t1190
  - cve.2026.77568

YARA Rule

rule CVE_2026_77568_Mojolicious_CSRF_Token_BREACH
{
    meta:
        description = "Detects Mojolicious source referencing static per-session CSRF helpers relevant to CVE-2026-77568"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77568"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "csrf_field" ascii
        $b = "csrf_token" ascii
        $c = "csrf_protect" ascii
        $d = "Mojolicious" ascii

    condition:
        ($d and any of ($a, $b, $c))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77568 Possible BREACH CSRF Token Oracle (Mojolicious)"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Accept-Encoding"; nocase; content:"gzip"; nocase; threshold:type both, track by_src, count 150, seconds 300; classtype:attempted-recon; reference:cve,2026-77568; sid:202677568; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "GET" and http.response.status_code == 200]
  [http where http.request.method == "GET" and http.response.status_code == 200]
  [http where http.request.method == "GET" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET
| bin _time span=5m
| stats count AS req_count, dc(uri_query) AS distinct_queries, avg(bytes) AS avg_bytes by src_ip, uri_path, _time
| where req_count > 150 AND distinct_queries > 100
| table _time, src_ip, uri_path, req_count, distinct_queries, avg_bytes

Wazuh OSSEC Rule

<group name="web,cve-2026-77568,">
  <rule id="2026775" level="6">
    <decoded_as>json</decoded_as>
    <field name="http.method">GET</field>
    <field name="http.response.status_code">200</field>
    <description>CVE-2026-77568: Possible BREACH CSRF token oracle - repeated GET requests to same endpoint</description>
    <options>no_full_log</options>
    <group>attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Upgrade to Mojolicious 9.48 or later, which the NVD description states fixes the issue.
   • If upgrade is not immediately possible, disable HTTP response compression on any browser-facing route that renders the CSRF token into HTML while also reflecting user-controlled input.
   • Ensure CSRF tokens are not rendered on pages that reflect attacker-influenced content.
   • Mask or vary compressed output length (e.g., randomized padding) on affected responses where feasible.

2. Patch/upgrade steps

   • Track the Mojolicious release channel and apply 9.48+.
   • Because patch confidence is 0/4 and no vendor advisory or patch source is tracked, verify the fix by testing that csrf_field, csrf_token, and csrf_protect no longer emit a static per-session token in compressed HTML under 9.48+.
   • Validate in staging that API-only endpoints are unaffected and confirm no regression in token handling.

3. Long-term hardening

   • Adopt per-request CSRF tokens (or token-per-response) instead of static per-session tokens.
   • Avoid reflecting arbitrary user input into responses that also contain secrets.
   • Apply the general BREACH countermeasure set: disable compression on sensitive pages, separate secrets from reflected content, and randomize response length.
   • Monitor for the high-volume, rapidly changing request patterns described in the Detection Guidance.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77568
• Mojolicious project (framework): https://mojolicious.org/
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-77568 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for CVE-2026-77568 as of this report): https://www.first.org/epss/

Note on threat actor activity: No public proof-of-concept, exploit code, Nuclei template, or CISA KEV entry is associated with CVE-2026-77568 at the time of writing. No specific threat actor campaign or in-the-wild exploitation evidence has been reported.