PT-2023-10311 · Jhipster · Generator-Jhipster

Ghost · Published 2023-10-31 · Updated 2023-11-08 · CVE-2015-20110

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JHipster generator-jhipster versions prior to 2.23.0

Description The issue allows for a timing attack against the validateToken function due to a string comparison that stops at the first different character. This enables attackers to guess tokens through brute force, one character at a time, by observing the timing. The search space is reduced to a linear amount of guesses based on the token length times the possible characters.

Recommendations For versions prior to 2.23.0, update to version 2.23.0 or later to resolve the issue. As a temporary workaround, consider implementing a constant-time comparison for the validateToken function to prevent timing attacks.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-208

CWE-307

Related Identifiers

CVE-2015-20110

GHSA-4GPM-R23H-GPRW

Affected Products

Generator-Jhipster

References · 7

• https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0 · Patch
• https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc · Patch
• https://github.com/jhipster/generator-jhipster/issues/2095 · Vendor Advisory
• https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-20110 · Security Note
• https://osv.dev/vulnerability/GHSA-4gpm-r23h-gprw · Vendor Advisory
• https://github.com/jhipster/generator-jhipster · Note