CVE-2024-58278
📋 TL;DR
Perl2exe versions up to V30.10C contain an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts by controlling the 0th argument of packed executables. This enables attackers to bypass restrictions and gain unauthorized access to systems. Organizations using perl2exe to package Perl scripts into executables are affected.
💻 Affected Systems
- perl2exe
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/administrator privileges, installing persistent backdoors, stealing sensitive data, and pivoting to other systems.
Likely Case
Local privilege escalation allowing attackers to execute arbitrary code with elevated permissions, potentially leading to data theft or system manipulation.
If Mitigated
Limited impact if proper access controls, least privilege principles, and execution restrictions are in place to prevent unauthorized script execution.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB. Attack requires local authenticated access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.indigostar.com/
Restart Required: No
Instructions:
Check vendor website for updated version. If unavailable, consider alternative Perl packaging solutions or implement workarounds.
🔧 Temporary Workarounds
Restrict perl2exe usage
linuxLimit access to perl2exe tool to authorized users only and monitor its usage.
chmod 750 /usr/bin/perl2exe
chown root:trustedgroup /usr/bin/perl2exe
Implement execution restrictions
allUse application whitelisting or execution policies to prevent unauthorized script execution.
🧯 If You Can't Patch
- Remove perl2exe from production systems and use alternative Perl packaging tools
- Implement strict access controls and monitor for suspicious perl2exe usage patterns
🔍 How to Verify
Check if Vulnerable:
Check perl2exe version: perl2exe --version or examine installed package versionCheck Version:
perl2exe --versionVerify Fix Applied:
Verify perl2exe is removed or updated to version above V30.10C📡 Detection & Monitoring
Log Indicators:
- Unusual perl2exe execution patterns
- Multiple perl2exe processes from same user
- Execution of unexpected scripts via perl2exe
Network Indicators:
- Outbound connections from perl2exe processes to unexpected destinations
SIEM Query:
process_name="perl2exe" AND (command_line="*malicious*" OR command_line="*suspicious*")