/ 
Apache-AppSamurai-1.01
Security Advisories (1)
CVE-2026-19565 (2026-08-23)

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. CreateSession calls it with an empty key source on every login, and the optional Keysource directive is the only route to the other branch. The result is 64 hex characters. The microsecond field of the first reading takes one of a million values, the later readings follow it within microseconds, and the process id is drawn from a small range. The key is returned to the browser as the session cookie, and is combined with the configured server key to compute the session id and to encrypt the stored session data. An attacker who knows the second in which a session was created and the process id of the worker that created it can enumerate candidate keys and recover the victim's cookie, bypassing authentication for the protected resources. Each candidate has to be tried against the server, which validates the cookie with a key the attacker does not hold.

Changes for version 1.01 - 2008-05-03

  • REQUIRED CHANGE - The new login form signature check (described below) require changes to login.pl and login.html. It is recommended that you replace your existing login.pl with examples/htdocs/login.pl. To preserve your customizations to login.html, it is recommended that you add in changes manually. For most cases, you should be able to add lines right after:
    • <input type="hidden" name="destination" value="__URI__" />
    • to support the changes. Add the following to your login.html:
      • <input type="hidden" name="nonce" value="__NONCE__" /> <input type="hidden" name="sig" value="__SIG__" />
  • Added nonce and signature to login.pl login form and checking in Apache::AppSamurai::login(). All form logins must now provide a valid nonce and signature. This is a Cross Site Request Forgery style protection, but since the user is not yet logged in, does not ACTUALLY provide CSRF protection. Instead, it is a additional bar to raise and prevent some types of scripted brute force/DoS attempts.
  • Added AuthSimple.pm, a authentication module for the Authen::Simple authentication framework, which supports numerous authentication methods (Kerberos, LDAP, PAM, etc.)
  • Changed Build.PL to attempt to pre-detect mod_perl version installed, adding requirement for mod_perl 2 if nothing is found
  • Changed Build.PL to attempt to pre-detect cipher module for use with Crypt::CBC, adding requirement for Crypt::Rijndael if none are found
  • Added "use warnings" to all modules
  • Added Pod test (Pod Coverage test left disabled until more methods are documented or set to ignore)

Modules

Apache::AppSamurai::AuthWhatchamcallit
Apache::AppSamurai
An Authenticating Mod_Perl Front End
Apache::AppSamurai::AuthBase
Base module for all AppSamurai authentication sub modules.
Apache::AppSamurai::AuthBasic
Check credentials against backend web server using HTTP basic auth
Apache::AppSamurai::AuthRadius
Check credentials against RADIUS service
Apache::AppSamurai::AuthSimple
Check credentials with Authen::Simple framework
Apache::AppSamurai::Session
Apache::AppSamurai wrapper for Apache::Session
Apache::AppSamurai::Session::Generate::HMAC_SHA
HMAC/SHA256 session generator for Apache::AppSamurai::Session
Apache::AppSamurai::Session::Serialize::CryptBase64
Storable, AES, and MIME::Base64 for session serializer
Apache::AppSamurai::Tracker
Apache::AppSamurai scratch-pad/tracking storage
Apache::AppSamurai::Util
Apache::AppSamurai utility methods

Examples

Other files