Malware in Crypt::SelfCertificate Perl Module

Executive Summary

Crypt::SelfCertificate versions 1.01 through 1.05 for Perl contain malware. The generate_certificate function runs a Python script saved as a certificate file. This script downloads and executes code from a hardcoded obfuscated HTTP URL without saving the script on the host. The malware is embedded in sample files validate.p12 (1.01) and cert7.pem (1.05).

The vulnerability allows arbitrary code execution as the user running the script. The payload is fetched directly from a remote server, bypassing local file storage.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the malicious files validate.p12 or cert7.pem in the Crypt::SelfCertificate module directories. Use commands like 'find / -name validate.p12 2>/dev/null' or 'find / -name cert7.pem 2>/dev/null' to search for these files.

Useful 0 Not Useful 0

Impact Analysis

If you installed any version from 1.01 to 1.05 of Crypt::SelfCertificate, your system may execute malicious code without your knowledge. The code runs with your user permissions, potentially allowing attackers to take control of your system, steal data, or install further malware.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data leaks or system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Remove the Crypt::SelfCertificate module from your system immediately. Check for any unusual network activity or unauthorized processes running Python scripts. Monitor system logs for suspicious outbound connections.

Useful 0 Not Useful 0