CVE-2025-15604
Tokuhirom Amon2 ≤ 6.17
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-15604 is a critical-severity PRNG (CWE-338) vulnerability in Tokuhirom Amon2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forge Web Credentials (T1606); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-15604 is a critical vulnerability in the Amon2 Perl web framework, affecting versions before 6.17. The issue stems from an insecure implementation of the random_string function, which is used for generating security-sensitive values such as session IDs, secrets for signing or encrypting cookie session data, and Cross-Site Request Forgery (CSRF) protection tokens. In versions 6.06 through 6.16, if /dev/urandom is unavailable, the function falls back to generating bytes via a SHA-1 hash seeded with Perl's built-in rand() function, the process ID (PID), and high-resolution epoch time; these seeds are predictable due to the limited PID range, guessable timestamps (potentially leaked via HTTP Date headers), and rand()'s unsuitability for cryptography. Earlier versions had even weaker mechanisms: no fallback before 6.06 and direct use of rand() for alphanumeric strings before 6.04. The vulnerability is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 338 (Use of Cryptographically Weak Pseudo-Random Number Generator) and 340 (Generation of Predictable Numbers or Identifiers).
Remote attackers require no privileges or user interaction to exploit this, as it enables prediction of security tokens over the network with low complexity. By guessing session IDs, cookie signing secrets, or CSRF tokens—leveraging observable patterns like PIDs and timestamps—an attacker can impersonate users, hijack sessions, decrypt or forge cookie data, bypass CSRF protections, and potentially achieve full compromise of affected applications (high confidentiality, integrity, and availability impact).
Advisories recommend upgrading to Amon2 version 6.17, which addresses the issue via changes to the random_string function in lib/Amon2/Util.pm, as detailed in the release changes, a specific code diff, and GitHub pull request #135. A MetaCPAN security guide emphasizes using proper random data sources for security contexts, and the OSS-security mailing list announcement highlights the fallback mechanism's flaws. Ensure /dev/urandom availability in deployment environments to avoid reliance on insecure fallbacks even in patched versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209114
Vulnerability Data
Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes…
more
by concatenating a SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Before version 6.06, there was no fallback when /dev/urandom was not available. Before version 6.04, the random_string function used the built-in rand() function to generate a mixed-case alphanumeric string. This function may be used for generating session ids, generating secrets for signing or encrypting cookie session data and generating tokens used for Cross Site Request Forgery (CSRF) protection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 9 hardening rules · 4 OS baselines
V7.2.3V11.5.1V11.3.4
Mitigating Controls (NIST 800-53 r5) AI
Requiring specific approved cryptography for protection directly mandates use of strong PRNGs instead of weak ones.
Developer testing and evaluation can discover predictable number generation through targeted analysis or fuzzing of identifier creation routines.
Cryptographic key establishment and management mandates proper entropy and randomness during generation, directly stopping predictable identifiers at the source.
Authenticator management requires secure initial distribution and handling of authenticators, structurally preventing predictable values from being usable.
Engineering principles applied during design and development include selection of cryptographically strong random number generation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.
Security testing can detect use of weak random number generators.
Secure SDLC processes should catch weak PRNG usage during design and code review.
Application security requirements can specify cryptographically strong random number generation.
Secure engineering principles include selection of appropriate cryptographic primitives.
Secure coding standards prohibit use of weak PRNGs in security contexts.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-340
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-338
- V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-340
RHEL 7 (1 rule)
- V-204497 The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-340
RHEL 8 (2 rules)
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-338
- V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-340
Ubuntu 22.04 (1 rule)
- V-260650 Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-338