CVE-2023-31486
📋 TL;DR
HTTP::Tiny versions before 0.083 have an insecure default TLS configuration that does not verify SSL/TLS certificates by default, requiring users to explicitly opt-in for verification. This vulnerability allows man-in-the-middle attacks where attackers can intercept and manipulate HTTPS traffic. It affects Perl applications using HTTP::Tiny for HTTPS connections, including many CPAN modules and systems with Perl 5.13.9+.
💻 Affected Systems
- HTTP::Tiny (Perl module)
- Perl core (5.13.9+)
- Various CPAN modules using HTTP::Tiny
📦 What is this software?
\ by Http\
Perl by Perl
⚠️ Risk & Real-World Impact
Worst Case
Attackers can perform full man-in-the-middle attacks, intercepting and modifying sensitive data (credentials, tokens, API calls) transmitted over HTTPS, potentially leading to data breaches, account compromise, or system takeover.
Likely Case
Attackers on the same network can intercept HTTPS traffic to steal session cookies, API keys, or other sensitive information transmitted by vulnerable applications.
If Mitigated
With proper certificate verification enabled, HTTPS connections are secure and resistant to man-in-the-middle attacks.
🎯 Exploit Status
Exploitation requires network access to intercept traffic. Proof-of-concept code is publicly available demonstrating man-in-the-middle attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: HTTP::Tiny 0.083+
Vendor Advisory: https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
Restart Required: Yes
Instructions:
1. Update HTTP::Tiny to version 0.083 or later using CPAN: 'cpan HTTP::Tiny' 2. For Perl core installations, update Perl or apply the HTTP::Tiny patch 3. Restart affected Perl applications/services
🔧 Temporary Workarounds
Enable certificate verification in code
allExplicitly enable SSL certificate verification in HTTP::Tiny calls
my $http = HTTP::Tiny->new(verify_SSL => 1);
Set environment variable
linuxForce certificate verification via PERL_LWP_SSL_VERIFY_HOSTNAME environment variable
export PERL_LWP_SSL_VERIFY_HOSTNAME=1
🧯 If You Can't Patch
- Implement network-level controls to prevent man-in-the-middle attacks (VPNs, network segmentation)
- Monitor for unusual outbound HTTPS connections and certificate validation failures
🔍 How to Verify
Check if Vulnerable:
Check HTTP::Tiny version: 'perl -MHTTP::Tiny -e "print HTTP::Tiny->VERSION"' - if version < 0.083, vulnerableCheck Version:
perl -MHTTP::Tiny -e "print HTTP::Tiny->VERSION"Verify Fix Applied:
Verify version is 0.083+: 'perl -MHTTP::Tiny -e "print HTTP::Tiny->VERSION"' should show 0.083 or higher📡 Detection & Monitoring
Log Indicators:
- HTTPS connection failures due to certificate validation
- Unusual outbound HTTPS connections from Perl processes
Network Indicators:
- Unencrypted or suspicious HTTPS traffic from Perl applications
- Certificate validation failures in network logs
SIEM Query:
process.name:perl AND network.protocol:https AND (event.outcome:failure OR certificate.validation:failed)🔗 References
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://security.netapp.com/advisory/ntap-20241129-0011/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
