CVE-2024-45321: App::cpanminus RCE Vulnerability

CVE-2024-45321 Overview

CVE-2024-45321 affects the App::cpanminus package through version 1.7047 for Perl. The tool downloads Perl module code over insecure HTTP rather than HTTPS. Network attackers positioned between the client and CPAN mirrors can intercept and replace downloaded modules. Because cpanm executes module build scripts during installation, code substitution leads to arbitrary code execution on the installing host. The flaw is categorized under [CWE-494] Download of Code Without Integrity Check. The issue was published to the National Vulnerability Database on August 27, 2024.

Critical Impact
A network-positioned attacker can replace Perl modules in transit and achieve arbitrary code execution during cpanm installation operations.

Affected Products

App::cpanminus (cpanm) versions through 1.7047
Perl environments using cpanm to install CPAN modules over default mirrors
CI/CD pipelines and developer workstations relying on cpanm for dependency installation

Discovery Timeline

2024-08-26 - MetaCPAN Security publishes analysis of insecure HTTP downloads in cpanminus
2024-08-27 - CVE-2024-45321 published to NVD
2024-12-05 - Last updated in NVD database

Technical Details for CVE-2024-45321

Vulnerability Analysis

The App::cpanminus client resolves and downloads Perl distributions from CPAN mirrors. By default the client uses plain HTTP URLs to fetch tarballs and metadata. HTTP transport provides no transport-layer authenticity or integrity, so any party able to observe or intercept network traffic can modify the response body. When cpanm unpacks the modified tarball and runs the distribution's Makefile.PL or Build.PL, attacker-controlled Perl code executes under the privileges of the user invoking the installer.

The weakness is classified as [CWE-494] Download of Code Without Integrity Check. cpanminus does not verify cryptographic signatures on retrieved distributions, so even mirror-side tampering is not detected. The Exploit Prediction Scoring System (EPSS) places the probability at 0.737%.

Root Cause

The root cause is the use of insecure HTTP URLs for CPAN mirror retrieval combined with the absence of distribution signature verification. Code is fetched, unpacked, and executed without proving it originated from CPAN or matched a trusted hash.

Attack Vector

Exploitation requires a network position between the victim host and the CPAN mirror. Suitable positions include shared Wi-Fi networks, compromised upstream routers, malicious proxies, ARP-spoofed LAN segments, and rogue DNS resolvers. The attacker rewrites the HTTP response with a malicious tarball whose build script executes arbitrary commands during cpanm Some::Module.

The vulnerability is described in prose only; refer to the MetaCPAN Security Analysis and the GitHub Issue Report for technical details.

Detection Methods for CVE-2024-45321

Indicators of Compromise

Outbound HTTP requests from developer workstations or build agents to cpan.org, metacpan.org, or other CPAN mirrors on TCP port 80
Unexpected child processes spawned by cpanm or perl during module installation, including shells, downloaders, or compilers writing to non-standard paths
Modifications to ~/.cpanm/, ~/perl5/, or system Perl library directories outside of scheduled deployments

Detection Strategies

Inspect proxy and firewall logs for User-Agent strings beginning with cpanminus/ over plaintext HTTP
Hunt for cpanm invocations in shell history and CI logs, then correlate against expected change windows
Compare hashes of installed CPAN distributions against published CPAN checksums to detect tampered tarballs

Monitoring Recommendations

Alert on any plaintext HTTP egress from build infrastructure, treating CI runners as high-value identities
Capture process ancestry for perl, cpanm, make, and gcc during package installs to surface anomalous post-install execution
Ingest endpoint and network telemetry into a central data lake to correlate package installation events with subsequent suspicious behavior

How to Mitigate CVE-2024-45321

Immediate Actions Required

Reconfigure cpanm to use HTTPS mirrors exclusively by passing --mirror https://cpan.metacpan.org/ or setting PERL_CPANM_OPT
Block outbound TCP/80 from developer and CI environments to CPAN mirror hostnames at the egress firewall
Audit recent cpanm installations on shared build infrastructure and reinstall modules from a trusted HTTPS mirror

Patch Information

The upstream fix is tracked in the GitHub Pull Request against the cpanminus repository. Until a fixed release is consumed across the toolchain, operators must enforce HTTPS through configuration. Additional context is available in the GitHub Issue Report.

Workarounds

Pin cpanm to a curated internal mirror served over HTTPS with a valid certificate, and reject upstream redirects to HTTP
Use cpm or carton with HTTPS-only sources where feasible, and verify distribution checksums against CPAN metadata
Run module installations inside ephemeral, network-restricted containers to limit blast radius if a tampered distribution executes

bash

# Configuration example: force cpanm to use HTTPS mirrors
export PERL_CPANM_OPT="--from https://cpan.metacpan.org/ --mirror-only"
cpanm Some::Module