Insecure Repository Configuration in generator-jhipster
Summary
GHSA-mc84-xr9p-938r: High severity vulnerability that affects generator-jhipster. Affects generator-jhipster versions < 6.3.1. Fixed in 6.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
generator-jhipster is an npm package that provides a powerful and popular generator for creating Java and Spring Boot applications. It simplifies the development process by generating code and configuring the project structure. However, a high severity vulnerability has been identified in generator-jhipster that affects the security of the generated code.
Vulnerability Detail
The vulnerability arises from the use of repository configurations that download dependencies over HTTP instead of HTTPS. This means that Gradle users who were using the http://repo.spring.io/plugins-release repositories were susceptible to a man-in-the-middle attack during the build process. An attacker could intercept the HTTP traffic and modify the downloaded dependencies, potentially leading to the execution of malicious code or other unauthorized actions.
How To Fix
Minimum fixed version
6.3.1
This is the first release that contains the fix.
npm install generator-jhipster@6.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To work around this vulnerability, replace all custom repository definitions in build.gradle or pom.xml with their HTTPS versions. For example:
<repository>
<id>oss.sonatype.org-snapshot</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be HTTPS
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>
maven { url "https://repo.spring.io/plugins-release" } // <-- must be HTTPS
Conclusion
Insecure repository configuration in generator-jhipster exposes users to the risk of man-in-the-middle attacks during the build process. To mitigate this vulnerability, it is crucial to upgrade to the recommended versions or ensure that all repository definitions use HTTPS. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for generator-jhipster →
FAQ
The vulnerability allows for a man-in-the-middle attack during the build process, potentially leading to the execution of malicious code or unauthorized actions.
Maven users should upgrade to version 6.3.0 or higher, while Gradle users should update to version 6.3.1. Alternatively, ensure that no Maven repository is used via HTTP in the build file.
Yes, you can replace all custom repository definitions in build.gradle or pom.xml with their HTTPS versions.
You can find more information about this vulnerability in the advisory at https://github.com/jhipster/generator-jhipster/issues
Yes, the CVSS score for this vulnerability is 8.1 (High severity).
References
Related vulnerabilities
Recent vulnerabilities recorded for generator-jhipster.
