Executive brief
JHipster is a popular development tool that generates Java web application scaffolding. The generated build configuration files incorrectly default to downloading dependencies over unencrypted HTTP instead of HTTPS, allowing attackers on the same network to intercept and replace those dependencies with malicious code during the build process. This could lead to compromise of any application built with an affected version.
Technical details
The vulnerability is a case of CWE-494 (download without integrity check) and CWE-829 (untrusted functionality inclusion) in generated Maven and Gradle build files. JHipster generates build configuration that references Maven Central repositories using HTTP instead of HTTPS, specifically the Spring plugin repository at http://repo.spring.io/plugins-release. An attacker positioned on the network path between the developer's build machine and the repository can perform a man-in-the-middle attack to serve malicious artifacts. This attack requires no special privileges or user interaction, though the attacker must have network positioning (intermediate routing). Maven users are affected up to version 6.3.0; Gradle users up to 6.3.1. The fix updates generated repository URLs to use HTTPS.
Affected products
- JHipster generator-jhipster <6.3.1
Timeline
- 2019-09-20: disclosed
- 2019-09-20: patched: Maven users: 6.3.0; Gradle users: 6.3.1