A critical vulnerability in the Mojolicious framework for Perl allows unauthenticated attackers to recover session tokens through a BREACH compression oracle attack, leading to potential CSRF bypasses.

This vulnerability involves an observable response discrepancy where the framework caches a stable CSRF token that is susceptible to a BREACH oracle attack. An unauthenticated attacker can exploit this when the application echoes attacker-controlled input within a gzip-compressed response.

The ability to recover CSRF tokens allows attackers to bypass security controls designed to prevent unauthorized state-changing requests, such as account modifications or administrative actions. Given the critical 9.1 CVSS score, this flaw poses a significant risk to data integrity and session security, as it effectively nullifies one of the primary defenses against cross-site request forgery.

Immediate Action: Upgrade to Mojolicious version 9.48 or later to resolve the underlying token handling issue.

Proactive Monitoring: Review application logs for patterns of high-frequency requests or unusual error codes that might indicate an attacker probing for response size variations.

Compensating Controls: If immediate patching is not possible, disable HTTP compression (gzip) for endpoints that reflect user-controlled input, as this effectively neutralizes the BREACH oracle mechanism.

Public Exploit Available: No (exploit_available unknown).

The severity of this vulnerability, combined with the ease of exploitation over a network, necessitates prompt action. Administrators should prioritize upgrading to version 9.48 or higher immediately to eliminate the risk of CSRF token exposure. If an immediate upgrade is not feasible, consider implementing compensating controls such as disabling compression on sensitive endpoints to protect against the BREACH attack vector.