CVE-2025-22376

What it actually does

The default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong, allowing predictable nonce values in OAuth requests.

Why it matters to the business

Attackers may predict nonces to perform replay attacks against OAuth flows, risking unauthorized access to resources; low urgency given no KEV listing, stable low EPSS, and limited ecosystem prevalence.

How an attack unfolds

An attacker monitors OAuth traffic or analyzes the weak rand() implementation to predict nonce sequences, then replays or forges requests using guessed nonces to bypass authentication protections in affected Perl OAuth clients.

How to fix it

Upgrade Net::OAuth to version 0.29 or later; for listed affected products apply imagemagick (Ubuntu:14.04:LTS) fixed in 8:6.7.7.10-6ubuntu3.11 or imagemagick (Ubuntu:16.04:LTS) fixed in 8:6.8.9.9-7ubuntu5.11.

How to confirm the fix worked

Confirm Net::OAuth version 0.29+ is installed and that nonce generation now uses a cryptographically secure source; scan package versions against the provided fixed imagemagick releases on Ubuntu 14.04/16.04 systems.

Typical attack path

1. Locate services using vulnerable Net::OAuth versions for OAuth client operations
2. Analyze or observe rand() behavior to predict 32-bit nonce values
3. Craft or replay OAuth requests incorporating predicted nonces
4. Bypass nonce validation to obtain unauthorized tokens or access

How to detect it

Review application logs for OAuth requests with repeated or sequential nonce patterns; inspect Perl module versions and source for rand() nonce calls; no specific threat actor TTPs reported.

What your security team should do

• Prioritize upgrade of Net::OAuth to 0.29+ across all Perl OAuth clients
• Audit OAuth implementations for custom nonce handling and replace any rand() usage
• Monitor for any increase in EPSS or new exploit maturity indicators