Is CVE-2015-20110 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-20110 being exploited in the wild.

How severe is CVE-2015-20110?

Low severity, with a CVSS score of 3.1, published 31 October 2023.

Which products and versions are affected?

generator-jhipster (npm) SEMVER:introduced=0,fixed=2.23.0.

Is there a fix for CVE-2015-20110?

Yes. generator-jhipster (npm): upgrade to 2.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-20110 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-20110?

Check whether you run generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-20110: JHipster generator-jhipster timing attack in token validation

CVE-2015-20110 · Severity: low · CVSS 3.1 · Published 2023-10-31

JHipster is a web application generator that creates modern Java-based web applications and microservices. The generator includes a token validation mechanism that uses an insecure string comparison function, allowing attackers to forge authentication tokens by observing minute timing differences in validation responses. An attacker could forge valid tokens to impersonate any user and gain unauthorized access to applications built with vulnerable versions of this generator.

Technologies: generator-jhipster (npm). Vendors: npm.

Quick answers

Is CVE-2015-20110 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-20110 being exploited in the wild.
How severe is CVE-2015-20110?: Low severity, with a CVSS score of 3.1, published 31 October 2023.
Which products and versions are affected?: generator-jhipster (npm) SEMVER:introduced=0,fixed=2.23.0.
Is there a fix for CVE-2015-20110?: Yes. generator-jhipster (npm): upgrade to 2.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-20110 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-20110?: Check whether you run generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

generator-jhipster (npm): upgrade to 2.23.0 or later
```
npm install generator-jhipster@2.23.0
```

Technical details

The vulnerability is a timing attack against the validateToken method in the TokenProvider class. The vulnerable code uses String.equals() to compare user-supplied authentication tokens with a calculated expected token, which returns false immediately upon the first character mismatch rather than comparing all characters in constant time. This allows attackers to brute-force valid tokens one character at a time by measuring response latency differences (CWE-208 Information Exposure Through Timing Difference, CWE-307 Improper Restriction of Rendered UI Layers or Frames). The attack requires network access to an affected application and no authentication; an attacker simply sends crafted tokens and observes timing variations to narrow down valid token values. The fix, released in version 2.23.0, replaces the vulnerable String.equals() comparison with a constant-time comparison function that always takes the same duration regardless of where characters differ.

Affected products

JHipster generator-jhipster before 2.23.0

Identifiers

CVE-2015-20110
GHSA-4gpm-r23h-gprw

Timeline

2015-10-06: disclosed: Vulnerability reported in GitHub issue #2095
2015-10: patched: Fixed in version 2.23.0
2023-10-31: advisory: GHSA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.