A vulnerability in the PAGI::Middleware::Session::Store::Cookie Perl module allows attackers to potentially decrypt or tamper with session cookies due to weak initialization vector generation.

This vulnerability involves the use of a cryptographically weak pseudo-random number generator (CWE-338) and the subsequent generation of a weak initialization vector (CWE-1204). The module falls back to an insecure random function when /dev/urandom is unavailable, which can be triggered by any unauthenticated remote attacker.

The use of predictable initialization vectors undermines the confidentiality of session data stored in cookies. A successful exploit could allow an attacker to decrypt session information or perform unauthorized session tampering. Given the CVSS score of 7.5, this represents a significant risk to user session integrity and application security, potentially leading to unauthorized access to user accounts.

Immediate Action: Upgrade the PAGI::Middleware::Session::Store::Cookie module to version 0.001004 or newer to resolve the random number generation flaw.

Proactive Monitoring: Review web application logs for unusual session management patterns or repeated cookie validation errors that might indicate an attempt to manipulate session data.

Compensating Controls: While no direct WAF rule can fix the underlying code, ensure that session cookies are flagged as Secure and HttpOnly to limit the exposure of session data to client-side scripts.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a high risk to application confidentiality. Administrators should prioritize the update to version 0.001004 immediately, as it is the only effective way to ensure initialization vectors are generated securely. Failure to patch leaves user sessions vulnerable to decryption and potential hijacking.