Jhipster
Monthly
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.