Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.
The built-in rand function is predictable, and unsuitable for cryptography.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Crypt::PasswdMD5 <= 1.42
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/perl
# PoC for CVE-2026-6659: Demonstrating predictable salt generation
use strict;
use warnings;
# Simulate the vulnerable salt generation logic found in Crypt::PasswdMD5 <= 1.42
# The vulnerability relies on the predictability of the built-in rand().
sub generate_vulnerable_salt {
my $salt;
# Character set used in the module
my @saltchars = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');
# Generate 8 character salt
$salt .= $saltchars[rand(@saltchars)] for (1..8);
return $salt;
}
# Seed the random number generator with the current time (common default behavior)
# This makes the output predictable if the time is known.
srand(time());
print "Vulnerable Salt (Simulated): " . generate_vulnerable_salt() . "\n";
print "If an attacker knows the approximate time of generation, they can reproduce this salt.\n";