PAGI Middleware Session Store Cookie Insecure Random Byte Generation Vulnerability

A vulnerability exists in PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl, where random bytes are generated insecurely for use in encryption. The module attempts to read bytes from /dev/urandom for cryptographic purposes. However, on systems without this device, such as Windows, it falls back to using the built-in rand function, which is not cryptographically secure. This insecure random byte generation is used to create an initialization vector (IV) for encrypting session data stored in cookies. A predictable IV could potentially allow attackers to decrypt or tamper with the session data.

Impact

The vulnerability leads to the use of predictable initialization vectors in encryption, which could make it easier for attackers to decrypt and manipulate session data stored in cookies.

Remediation

Users can upgrade to PAGI::Middleware::Session::Store::Cookie version 0.001004 or later, which addresses the vulnerability by using Crypt::PRNG from CryptX for secure random byte generation.