QID 980765

QID 980765: Nodejs (npm) Security Update for generator-jhipster-kotlin (GHSA-j3rh-8vwq-wh84)

JHipster Kotlin is using an insecure source of randomness to generate all of it's random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.

From the documentation:

> Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.
> \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html

Here are the examples of JHipster Kotlin'ss use of an insecure PRNG:

https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32

## Proof Of Concepts Already Exist

There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.

https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd

POC Repository: https://github.com/alex91ar/randomstringutils

## Potential Impact Technical

All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.

## Potential Impact Scale

Not as large as for the original jhipster project as the kotlin blueprint is not that widely used.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Update your generated applications to > 1.2.0Workaround:
Change the content of `RandomUtil.kt` like this:

```kotlin
import java.security.SecureRandom
import org.apache.commons.lang3.RandomStringUtils

private const val DEF_COUNT = 20

object RandomUtil {
private val secureRandom: SecureRandom = SecureRandom()

init {
secureRandom.nextBytes(byteArrayOf(64.toByte()))
}

private fun generateRandomAlphanumericString(): String {
return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)
}

/**
* Generate a password.
*
* @return the generated password.
*/
fun generatePassword(): String = generateRandomAlphanumericString()
}
```

Important is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.

Vendor References

GHSA-j3rh-8vwq-wh84 - github.com/advisories/GHSA-j3rh-8vwq-wh84

CVEs related to QID 980765

CVE-2019-16303 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-j3rh-8vwq-wh84	generator-jhipster-kotlin		github.com/advisories/GHSA-j3rh-8vwq-wh84

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].