CVE-2026-46473 Authen::TOTP密钥生成漏洞

#!/usr/bin/perl # PoC: Demonstration of weak secret generation vulnerability # This script simulates the vulnerable behavior of Authen::TOTP < 0.1.1 # which uses non-cryptographic rand() for secret generation. use strict; use warnings; # Simulate the vulnerable secret generation logic sub generate_vulnerable_secret { my $length = shift || 16; my $secret = ''; # Vulnerable: Uses rand() which is predictable and not CSPRNG my @chars = ('A'..'Z', '2'..'7'); for (1..$length) { $secret .= $chars[rand(@chars)]; } return $secret; } print "[+] Simulating vulnerable secret generation...\n"; print "[+] Generated Weak Secret: " . generate_vulnerable_secret(16) . "\n"; print "[!] Note: An attacker observing the generation time/PID could predict this output.\n";