Executive brief
JHipster Kotlin is a code generator that creates backend applications with user authentication and password reset functionality. The generator uses a cryptographically weak random number generator (Java's Random class via Apache Commons) for creating password reset tokens and other security-sensitive values. An attacker who obtains a single password reset token can mathematically reverse-engineer all future tokens, enabling them to take over any user account without authorization.
Technical details
JHipster Kotlin uses Apache Commons Lang3's RandomStringUtils class, which relies on java.util.Random for token generation. java.util.Random is not cryptographically secure and uses a linear congruential generator that is predictable given a single output value. The vulnerability (CWE-338) allows an attacker to obtain one password reset token from a target application and use publicly available proof-of-concept tools to determine the seed and predict all past and future token values. This enables account takeover through targeted password reset requests. Affected versions are before 1.2.0; the fix involves replacing RandomStringUtils calls with SecureRandom-backed alternatives as documented in the patch release notes.
Affected products
- JHipster Kotlin before 1.2.0
Timeline
- 2019-09-13: disclosed
- 2020-06-26: advisory
- 2020-06-26: patched: v1.2.0 released