Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
The default session identifier generator in the Starch library creates an SHA-1 hash based on predictable input data: a counter, epoch time, Perl's built-in rand function, process identifier (PID), and internal Perl reference addresses. The PID comes from a limited range of values, the epoch time can be read from the HTTP Date header or guessed, while Perl's built-in rand function is not intended for cryptographic applications. The combination of these weak entropy sources makes the generated session identifiers predictable and reproducible by an attacker.
An attacker can predict or reproduce valid session identifiers and thus gain unauthorized access to systems and other users' accounts without the need to provide authentication credentials.
The Starch library should be updated to a version containing the fix described in commit 5573449e64e0660f7ee209d1eab5881d4ccbee3b available in the project's GitHub repository (pull request #5). Patch details are available at: https://github.com/bluefeet/Starch/commit/5573449e64e0660f7ee209d1eab5881d4ccbee3b.patch
Starch library version 0.14 and earlier (Perl language)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N