GitHub Advisoryadvisory · npm

GHSA-4gpm-r23h-gprw generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

HIGH Published 2023-10-31 Modified 2023-11-08 Official page ↗
Aliases
CVE-2015-20110
Ecosystem
npm
Packages
generator-jhipster
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-208, CWE-307
Reviewed
2023-10-31

Affected packages

• npm generator-jhipster: < 2.23.0 → fixed in 2.23.0

Description

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.

Related

Alias · CVE (1)

  • CVE-2015-20110 JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first… vulnerability

Weakness · CWE (2)

  • CWE-208 Observable Timing Discrepancy weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References