CVE-2024-45321
📋 TL;DR
CVE-2024-45321 is a vulnerability in App::cpanminus (cpanm) where the package downloads Perl modules over insecure HTTP connections instead of HTTPS. This allows network attackers to perform man-in-the-middle attacks and execute arbitrary code on systems using cpanm. Anyone using cpanm versions through 1.7047 to install Perl modules is affected.
💻 Affected Systems
- App::cpanminus (cpanm)
📦 What is this software?
\ by App\
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept HTTP downloads, inject malicious code into Perl modules, leading to full system compromise with the privileges of the user running cpanm.
Likely Case
Man-in-the-middle attackers in controlled networks (e.g., public Wi-Fi, compromised routers) inject malware during module installation, resulting in backdoor installation or data theft.
If Mitigated
With proper network controls (HTTPS proxies, certificate pinning), impact is limited to denial of service if downloads fail, but no code execution occurs.
🎯 Exploit Status
Exploitation requires the attacker to be in a position to intercept network traffic (e.g., on the same network or controlling a router).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.7048 or later
Vendor Advisory: https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html
Restart Required: No
Instructions:
1. Update cpanm using: cpan App::cpanminus. 2. Verify the update with: cpanm --version. 3. Ensure it reports 1.7048 or higher.
🔧 Temporary Workarounds
Force HTTPS downloads
allConfigure cpanm to use HTTPS for all downloads by setting environment variables.
export PERL_CPANM_OPT="--mirror https://cpan.metacpan.org"
export PERL_CPANM_IR="https://cpan.metacpan.org"
Use local CPAN mirror with HTTPS
allSet up a local CPAN mirror that uses HTTPS and configure cpanm to use it.
cpanm --mirror https://local-mirror.example.com --mirror-only
🧯 If You Can't Patch
- Disable cpanm usage and switch to alternative package managers like cpan or manual installations from trusted sources.
- Implement network-level controls such as HTTPS proxies or firewall rules to block HTTP traffic to CPAN repositories.
🔍 How to Verify
Check if Vulnerable:
Run: cpanm --version. If the version is 1.7047 or lower, the system is vulnerable.Check Version:
cpanm --versionVerify Fix Applied:
Run: cpanm --version. Confirm the version is 1.7048 or higher. Test by installing a module and checking if downloads use HTTPS in network logs.📡 Detection & Monitoring
Log Indicators:
- Log entries showing HTTP (not HTTPS) connections to CPAN repositories during cpanm operations.
- Unexpected network traffic or module downloads from non-standard sources.
Network Indicators:
- HTTP traffic to domains like cpan.metacpan.org or other CPAN mirrors on port 80.
- Unencrypted downloads of Perl module files (.tar.gz, .pm) over HTTP.
SIEM Query:
source="network_logs" AND (dest_port=80 AND dest_ip IN (CPAN_MIRROR_IPS) AND protocol="HTTP" AND user_agent LIKE "%cpanm%")