Junglewise Threat Intelligence

CVE-2015-20110: JHipster generator-jhipster timing attack in token validation

CVE-2015-20110 · Severity: low · CVSS 3.1 · Published 2023-10-31

Technologies: generator-jhipster (npm). Vendors: npm.

Executive brief

JHipster is a web application generator that creates modern Java-based web applications and microservices. The generator includes a token validation mechanism that uses an insecure string comparison function, allowing attackers to forge authentication tokens by observing minute timing differences in validation responses. An attacker could forge valid tokens to impersonate any user and gain unauthorized access to applications built with vulnerable versions of this generator.

Technical details

The vulnerability is a timing attack against the validateToken method in the TokenProvider class. The vulnerable code uses String.equals() to compare user-supplied authentication tokens with a calculated expected token, which returns false immediately upon the first character mismatch rather than comparing all characters in constant time. This allows attackers to brute-force valid tokens one character at a time by measuring response latency differences (CWE-208 Information Exposure Through Timing Difference, CWE-307 Improper Restriction of Rendered UI Layers or Frames). The attack requires network access to an affected application and no authentication; an attacker simply sends crafted tokens and observes timing variations to narrow down valid token values. The fix, released in version 2.23.0, replaces the vulnerable String.equals() comparison with a constant-time comparison function that always takes the same duration regardless of where characters differ.

Affected products

  • JHipster generator-jhipster before 2.23.0

Timeline

  • 2015-10-06: disclosed: Vulnerability reported in GitHub issue #2095
  • 2015-10: patched: Fixed in version 2.23.0
  • 2023-10-31: advisory: GHSA advisory published

References

Related threats