CVE-2020-4072: Generator jhipster kotlin Log Forging Vulnerability

MODERATE
Advisory Identifier: GHSA-pfxf-wh96-fvjc
Share
CVSS 5.3
CWE-117
Published
Advisory Summary

CVE-2020-4072 is a MODERATE (CVSS 5.3) log forging vulnerability (CWE-117: Improper Output Neutralization for Logs) affecting Generator jhipster kotlin libraries in the npm ecosystem. The issue involves log forging in generator-jhipster-kotlin. Remediation is available by upgrading affected packages to version 1.7.0.

CVE-2020-4072 at a Glance

CVE Identifier CVE-2020-4072
GHSA Identifier GHSA-pfxf-wh96-fvjc
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-117: Improper Output Neutralization for Logs
Affected Product Generator jhipster kotlin
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2020-4072

To remediate this vulnerability, upgrade all affected Generator jhipster kotlin dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

generator-jhipster-kotlin fixed: 1.7.0 
npm install generator-jhipster-kotlin@1.7.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls generator-jhipster-kotlin

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2020-4072, inspect your project dependencies using npm:

npm ls generator-jhipster-kotlin

Analyze the terminal output to locate any version of Generator jhipster kotlin in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.7.0), your application is affected.

Note: The npm ls generator-jhipster-kotlin command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-117: Improper Output Neutralization for Logs, where the product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file. In Generator jhipster kotlin, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. ### Patches version 1.7.0. ### Workarounds In `AccountResource.kt` you should change the line ```kotlin log.warn("Password reset requested for non existing mail '$mail'"); ``` to ```kotlin log.warn("Password reset requested for non existing mail"); ``` ### References * https://cwe.mitre.org/data/definitions/117.html * https://owasp.org/www-community/attacks/Log_Injection * https://www.baeldung.com/jvm-log-forging ### For more information If you have any questions or comments about this advisory: * Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)

CVE-2020-4072 Affected Generator jhipster kotlin Versions

1 component(s)
Fixed Versions:
1.7.0
Product / Package Ecosystem Affected Versions Fixed Version
generator-jhipster-kotlin
npm/generator-jhipster-kotlin
npm
≥ 1.6.0
< 1.7.0
All 1 versions
1.6.0
1.7.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc
NVD — CVE-2020-4072 NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4072
Security Fix Commit FIX COMMIT
https://github.com/jhipster/jhipster-kotlin/commit/426ccab85e7e0da562643200637b99b6a2a99449
owasp.org/www-community/attac... WEB
https://owasp.org/www-community/attacks/Log_Injection
www.baeldung.com/jvm-log-forging WEB
https://www.baeldung.com/jvm-log-forging

Frequently Asked Questions

What is CVE-2020-4072?
CVE-2020-4072 is a security vulnerability in Generator jhipster kotlin involving Log Forging in generator-jhipster-kotlin under CWE-117: Improper Output Neutralization for Logs.
Which Generator jhipster kotlin versions are affected?
Affected versions include releases prior to 1.7.0 across affected packages: generator-jhipster-kotlin.
What version fixes CVE-2020-4072?
Upgrading to 1.7.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is generator-jhipster-kotlin affected?
Yes, generator-jhipster-kotlin is affected in releases prior to 1.7.0. Upgrade your dependency to 1.7.0 or later.
What is the CVSS score of CVE-2020-4072?
CVE-2020-4072 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
What CWE is associated with CVE-2020-4072?
CVE-2020-4072 is classified under CWE-117: Improper Output Neutralization for Logs (The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.).
How can I check npm dependencies for CVE-2020-4072?
Run the dependency tree command: 'npm ls generator-jhipster-kotlin'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pfxf-wh96-fvjc",
  "modified" : "2021-01-07T23:50:00Z",
  "published" : "2020-06-25T20:02:51Z",
  "aliases" : [ "CVE-2020-4072" ],
  "summary" : "Log Forging in generator-jhipster-kotlin",
  "details" : "### Impact\n\nWe log the mail for invalid password reset attempts. \nAs the email is provided by a user and the api is public this can be used by an attacker to forge log entries.\nThis is vulnerable to https://cwe.mitre.org/data/definitions/117.html\n\nThis problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable.\n\n### Patches\n\nversion 1.7.0.\n\n### Workarounds\n\nIn `AccountResource.kt` you should change the line\n\n```kotlin\n log.warn(\"Password reset requested for non existing mail '$mail'\");\n```\n\nto \n\n```kotlin\n log.warn(\"Password reset requested for non existing mail\");\n```\n\n### References\n\n* https://cwe.mitre.org/data/definitions/117.html\n* https://owasp.org/www-community/attacks/Log_Injection\n* https://www.baeldung.com/jvm-log-forging\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "generator-jhipster-kotlin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.6.0"
      }, {
        "fixed" : "1.7.0"
      } ]
    } ],
    "versions" : [ "1.6.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-4072"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jhipster/jhipster-kotlin/commit/426ccab85e7e0da562643200637b99b6a2a99449"
  }, {
    "type" : "WEB",
    "url" : "https://owasp.org/www-community/attacks/Log_Injection"
  }, {
    "type" : "WEB",
    "url" : "https://www.baeldung.com/jvm-log-forging"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-117" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-25T20:02:31Z",
    "nvd_published_at" : null
  }
}