Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWozcmgtOHZ3cS13aDg0
JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0
JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 RandomStringUtils
.
From the documentation:
Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.
- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html
Here are the examples of JHipster Kotlin's use of an insecure PRNG:
Proof Of Concepts Already Exist
There has been a POC of taking one RNG value generated RandomStringUtils
and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.
POC Repository: https://github.com/alex91ar/randomstringutils
Potential Impact Technical
All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.
Potential Impact Scale
Not as large as for the original jhipster project as the kotlin blueprint is not that widely used.
Patches
Update your generated applications to > 1.2.0
Workarounds
Change the content of RandomUtil.kt
like this:
import java.security.SecureRandom
import org.apache.commons.lang3.RandomStringUtils
private const val DEF_COUNT = 20
object RandomUtil {
private val secureRandom: SecureRandom = SecureRandom()
init {
secureRandom.nextBytes(byteArrayOf(64.toByte()))
}
private fun generateRandomAlphanumericString(): String {
return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)
}
/**
* Generate a password.
*
* @return the generated password.
*/
fun generatePassword(): String = generateRandomAlphanumericString()
}
Important is to exchange every call of RandomStringUtils.randomAlphaNumeric
.
For more information
If you have any questions or comments about this advisory:
- Open an issue in JHipster Kotlin
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWozcmgtOHZ3cS13aDg0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-j3rh-8vwq-wh84, CVE-2019-16303
References:
- https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-j3rh-8vwq-wh84
- https://nvd.nist.gov/vuln/detail/CVE-2019-16303
- https://github.com/jhipster/generator-jhipster/issues/10401
- https://github.com/jhipster/jhipster-kotlin/issues/183
- https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7
- https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html
- https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c
- https://snyk.io/vuln/SNYK-JS-GENERATORJHIPSTER-466980
- https://www.npmjs.com/advisories/1187
- https://www.npmjs.com/advisories/1188
- https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd@%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897@%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9@%3Cissues.commons.apache.org%3E
- https://github.com/jhipster/jhipster-kotlin/commit/deec3587ef7721cf5de5b960d43e9b68beff6193
- https://github.com/advisories/GHSA-j3rh-8vwq-wh84
Blast Radius: 16.0
Affected Packages
npm:generator-jhipster-kotlin
Dependent packages: 3Dependent repositories: 43
Downloads: 1,928 last month
Affected Version Ranges: < 1.2.0
Fixed in: 1.2.0
All affected versions: 0.0.0, 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.1.0, 0.2.0, 0.2.1, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.6.1, 0.7.0, 0.8.0, 0.8.1, 1.0.0, 1.1.0
All unaffected versions: 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13.0, 1.14.0, 1.15.0, 1.16.0