CVE-2025-30672: Mite for Perl RCE Vulnerability

CVE-2025-30672 Overview

CVE-2025-30672 is an Uncontrolled Search Path Element vulnerability (CWE-427) affecting Mite for Perl versions prior to 0.013000. The vulnerability arises from generated code that adds the current working directory (.) to the Perl @INC path, creating a security weakness similar to the well-known CVE-2016-1238.

When Perl scripts generated by vulnerable versions of Mite are executed, they search for modules in the current working directory. If an attacker can place a malicious Perl module file in the directory where the script is run, that file may be loaded instead of a legitimate system module, potentially leading to arbitrary code execution.

Critical Impact

Arbitrary code execution through malicious module loading when attackers can write files to the current working directory where Mite-generated scripts execute.

Affected Products

• Mite for Perl versions before 0.013000
• Distributions containing code generated by affected Mite versions
• Applications relying on Mite-generated Perl code

Discovery Timeline

• April 1, 2025 - CVE-2025-30672 published to NVD
• April 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30672

Vulnerability Analysis

This vulnerability stems from insecure code generation practices in the Mite module for Perl. Mite is a development tool that generates object-oriented Perl code at author time rather than install time. The generated code inadvertently includes the current working directory (.) in the @INC module search path.

Starting with Perl 5.26, the dot (.) was intentionally removed from @INC as a security measure to prevent local file inclusion attacks. This change was made in response to CVE-2016-1238, which highlighted the dangers of searching the current directory for modules. The vulnerability in Mite effectively reintroduces this security issue by adding . back to the search path in its generated code.

The impact extends beyond the Mite distribution itself—any downstream distribution that ships code generated by an affected version of Mite inherits this vulnerability. This creates a supply chain risk where multiple packages may be affected without their maintainers being directly aware of the underlying issue.

Root Cause

The root cause is improper code generation in Mite that adds the current working directory to Perl's @INC module search path. This pattern was deprecated and removed from Perl's default behavior in version 5.26 due to the security risks it introduces. By regenerating this behavior, Mite undermines the security improvements made to the Perl runtime and exposes applications to module injection attacks.

Attack Vector

The attack vector requires an attacker to have write access to a directory where a vulnerable Mite-generated script will be executed. The attack follows this pattern:

An attacker identifies a system running Perl scripts generated by a vulnerable version of Mite. The attacker then places a malicious Perl module file (with a .pm extension) in a directory where the target script will be executed. When the script runs and attempts to load a legitimate module, Perl's @INC search order causes it to find and load the attacker's malicious file first from the current working directory. The malicious module's code is then executed with the permissions of the user running the script.

This attack is particularly effective in shared hosting environments, CI/CD pipelines, or any scenario where untrusted users can write files to directories where Perl scripts execute.

Detection Methods for CVE-2025-30672

Indicators of Compromise

• Unexpected Perl module files (.pm extension) appearing in application working directories
• Modified or newly created Perl files in directories where Mite-generated scripts execute
• Unusual process behavior or network connections originating from Perl interpreter processes
• Log entries indicating module loading from unexpected paths

Detection Strategies

• Audit installed Perl distributions for Mite versions earlier than 0.013000
• Scan generated Perl code for patterns that add . to @INC
• Monitor file creation events in directories where Perl applications run
• Implement file integrity monitoring on application directories

Monitoring Recommendations

• Enable Perl's warnings for deprecated @INC behaviors using the PERL_USE_UNSAFE_INC environment variable set to 0
• Log and alert on any attempts to load modules from the current working directory
• Monitor for unauthorized file writes in application runtime directories
• Audit Perl process execution for unexpected module loading paths

How to Mitigate CVE-2025-30672

Immediate Actions Required

• Upgrade Mite to version 0.013000 or later immediately
• Regenerate all code previously built with vulnerable Mite versions
• Audit downstream distributions for code generated by affected Mite versions
• Set PERL_USE_UNSAFE_INC=0 in your environment to enforce secure @INC behavior

Patch Information

The vulnerability has been addressed in Mite version 0.013000. Users should upgrade to this version and regenerate any code that was produced by earlier versions. The MetaCPAN Changes Log provides details about the security fix.

For additional background on the @INC security issue, consult the Perl Blog Post explaining what happened to dot in @INC, the Perl Documentation on the PERL_USE_UNSAFE_INC environment variable, and the Gentoo Wiki Project Overview on dot-in-INC removal.

Workarounds

• Set the PERL_USE_UNSAFE_INC environment variable to 0 to prevent loading modules from the current directory
• Ensure application working directories have restricted write permissions
• Run Perl scripts from directories where untrusted users cannot write files
• Implement directory permission controls to prevent unauthorized file placement

# Configuration example
# Set environment variable to disable unsafe @INC behavior
export PERL_USE_UNSAFE_INC=0

# Verify Mite version is patched
perl -MMite -e 'print $Mite::VERSION'

# Restrict directory permissions where Perl scripts execute
chmod 755 /path/to/application
chown root:root /path/to/application