GHSA-mc84-xr9p-938r High severity vulnerability that affects generator-jhipster

Not scored Published 23 Sep 2019

Generated build files use HTTP for repositories, allowing man-in-the-middle attacks to inject malicious code during build.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-mc84-xr9p-938r?

GHSA-mc84-xr9p-938r is a vulnerability in generator-jhipster, published on 23 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Generated code uses repository configuration that downloads over HTTP instead of HTTPS

Impact

Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1. If you are not able to upgrade make sure not to use a Maven repository via http in your build file.

Workarounds

Replace all custom repository definitions in build.gradle or pom.xml with their https version.

e.g.

 &lt;repository&gt;
            &lt;id&gt;oss.sonatype.org-snapshot&lt;/id&gt;
            &lt;url&gt;https://oss.sonatype.org/content/repositories/snapshots&lt;/url&gt; // &lt;-- must be httpS
            &lt;releases&gt;
                &lt;enabled&gt;false&lt;/enabled&gt;
            &lt;/releases&gt;
            &lt;snapshots&gt;
                &lt;enabled&gt;true&lt;/enabled&gt;
            &lt;/snapshots&gt;
&lt;/repository&gt;

maven { url &#34;https://repo.spring.io/plugins-release&#34; } // &lt;-- must be httpS

References

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/jhipster/generator-jhipster/issues

Which versions are affected by GHSA-mc84-xr9p-938r?

2 open source packages ship an affected version, including generator-jhipster.

Package	Affected	Fixed in
`generator-jhipster` npm	All versions	`6.3.1`
`generator-jhipster` npm	All versions	`6.3.1`

How do I fix GHSA-mc84-xr9p-938r?

Upgrade generator-jhipster to 6.3.1 or later.

Is GHSA-mc84-xr9p-938r being exploited?

There is no known exploitation of GHSA-mc84-xr9p-938r in the wild and no public exploit code.