Technical impact
The Amazon::Credentials Perl module versions through 1.2.0 uses the built‑in rand function to create a 64‑bit encryption key, which is predictable and unsuitable for cryptographic purposes. Because secrets are stored in an obfuscated form using this key, an attacker who can generate the expected rand sequence can derive the key and decrypt the credentials, directly compromising the confidentiality of stored secrets without requiring additional access beyond what is needed to read the encrypted data. This weakness falls under the cryptographically weak key generation flaw (CWE‑338).
Affected Systems
All versions of the BIGFOOT:Amazon::Credentials Perl module up to and including 1.2.0 are affected, as the issue is present in the encryption logic used in those releases.
Risk and Exploitability
The CVSS score is 5.3, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. However, the predictability of the rand‑based key allows a threat actor with read access to the encrypted credentials to compute the key. The attack vector is most likely local or application‑level, requiring the ability to read the obfuscated secrets, after which the attacker can decrypt them. The confidentiality impact is significant for any system that stores sensitive data using this module.
