CVE-2025-15618: Perl StoredTransaction Info Disclosure Flaw

CVE-2025-15618 Overview

CVE-2025-15618 is a critical insecure random number generation vulnerability affecting Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl. The module uses a cryptographically weak method to generate secret keys by computing an MD5 hash of a single call to Perl's built-in rand() function. This key generation approach is fundamentally unsuitable for cryptographic purposes, particularly given that the key is intended for encrypting sensitive credit card transaction data.

Critical Impact

Attackers can potentially predict or brute-force the secret key used to encrypt credit card transaction data, leading to unauthorized access to sensitive payment information and potential financial fraud.

Affected Products

• Business::OnlinePayment::StoredTransaction version 0.01 and earlier
• Perl applications utilizing this module for payment transaction storage
• E-commerce systems integrating this Perl module for credit card data handling

Discovery Timeline

• 2026-03-31 - CVE-2025-15618 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-15618

Vulnerability Analysis

This vulnerability falls under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). The Business::OnlinePayment::StoredTransaction module generates encryption keys using a fundamentally flawed approach that combines two weak cryptographic primitives.

The module creates a secret key by taking the MD5 hash of a value produced by Perl's rand() function. This approach has multiple security deficiencies. First, Perl's rand() function is a linear congruential generator designed for general-purpose randomness, not cryptographic security. Its output is deterministic and predictable once the seed is known or can be inferred. Second, the entropy available from a single rand() call is severely limited, making the key space far smaller than what would be expected from a properly generated cryptographic key.

The vulnerability is exploitable over the network without authentication or user interaction, making it particularly dangerous for internet-facing payment systems. Since the weak key protects credit card transaction data, successful exploitation could result in significant confidentiality and integrity breaches.

Root Cause

The root cause is the improper use of a non-cryptographic PRNG (rand()) combined with MD5 hashing to generate encryption keys for sensitive financial data. The rand() function in Perl uses a predictable algorithm that was never designed for security purposes. When combined with the limited entropy of a single function call, the resulting key space becomes feasibly brute-forceable by attackers.

Additionally, MD5 is considered cryptographically broken and unsuitable for security-sensitive applications, compounding the weakness of the key generation process.

Attack Vector

An attacker could exploit this vulnerability through the following approach:

The vulnerability exists in the key generation routine within the Perl module. As documented in the MetaCPAN Module Source Code, the problematic code generates the secret key using rand() and MD5 hashing.

An attacker with access to encrypted transaction data could:

1. Enumerate the limited key space resulting from the weak PRNG
2. Attempt decryption with each candidate key
3. Successfully recover plaintext credit card transaction data when the correct key is found

The attack requires no authentication or special privileges, as the weakness is inherent in how keys are generated and stored.

Detection Methods for CVE-2025-15618

Indicators of Compromise

• Presence of Business::OnlinePayment::StoredTransaction version 0.01 or earlier in Perl module installations
• Encrypted transaction files that may have been generated with weak cryptographic keys
• Unusual access patterns to stored transaction data files

Detection Strategies

• Audit Perl module dependencies using tools like cpanm --info or by examining META.json/META.yml files for Business-OnlinePayment-StoredTransaction installations
• Review application code for imports or usage of Business::OnlinePayment::StoredTransaction
• Implement file integrity monitoring on directories containing encrypted transaction data
• Scan for the vulnerable module version across development, staging, and production environments

Monitoring Recommendations

• Monitor access logs for unusual patterns of access to encrypted transaction storage locations
• Set up alerts for any new installations or updates of the affected Perl module
• Implement security scanning in CI/CD pipelines to detect usage of vulnerable module versions
• Review payment processing logs for anomalies that could indicate data exfiltration attempts

How to Mitigate CVE-2025-15618

Immediate Actions Required

• Identify all systems using Business::OnlinePayment::StoredTransaction and assess their exposure
• Apply the official patch from MetaCPAN CVE-2025-15618 Patch
• Re-encrypt any stored transaction data using properly generated cryptographic keys after patching
• Conduct a security review to determine if stored data may have been compromised
• Consider rotating or invalidating affected credit card data if exposure is suspected

Patch Information

The MetaCPAN security team has released a patch to address this vulnerability. The patch is available at the MetaCPAN CVE-2025-15618 Patch repository.

Organizations should apply this patch immediately to all affected installations. After patching, it is critical to regenerate encryption keys and re-encrypt any previously stored transaction data, as data encrypted with the weak key generation method remains vulnerable even after the code is patched.

For additional context and community discussion, refer to the Openwall OSS-Security Discussion.

Workarounds

• If immediate patching is not possible, disable or isolate systems using the vulnerable module until remediation can be completed
• Implement additional encryption layers at the application or infrastructure level using properly seeded cryptographic PRNGs
• Consider migrating to alternative, well-audited payment processing libraries with proper cryptographic implementations
• Restrict network access to affected systems to minimize exposure to potential attackers
• Implement enhanced monitoring and logging on systems that cannot be immediately patched

# Check for vulnerable module installation
perl -MBusiness::OnlinePayment::StoredTransaction -e 'print $Business::OnlinePayment::StoredTransaction::VERSION'

# Apply the security patch (download and review first)
curl -O https://security.metacpan.org/patches/B/Business-OnlinePayment-StoredTransaction/0.01/CVE-2025-15618-r1.patch
# Review the patch contents before applying
patch -p1 < CVE-2025-15618-r1.patch