Executive brief
The JHipster Kotlin generator creates backend code for web applications. A vulnerability in the password reset feature allows attackers to inject log entries by submitting forged email addresses to a public API endpoint, potentially manipulating application logs for deception or evasion purposes. This affects applications using JWT or session authentication, but not those using OAuth.
Technical details
A log forging vulnerability (CWE-117) exists in the AccountResource.kt component of generated applications. When handling password reset requests for non-existent email addresses, the application logs the user-supplied email directly without sanitization, allowing an attacker to inject newlines and craft malicious log entries. The vulnerability is triggered via an unauthenticated, network-accessible password reset endpoint that accepts email parameters. An attacker can craft requests with email values containing log injection payloads to forge arbitrary log entries. The issue is fixed in version 1.7.0 by removing the email from log output entirely.
Affected products
- JHipster generator-jhipster-kotlin 1.6.0 before 1.7.0
Timeline
- 2020-06-25: disclosed: Advisory published
- 2020-06-25: patched: Version 1.7.0 released with fix