DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
Java

Java

Made by DeepSource
Use Analyzer

Insecure RandomUtil implementations must not be used JAVA-S1036

Security
Critical
 a02 a07 cwe-640 cwe-338 owasp top 10

An instance of a RandomUtil implementation generated by JHipster was found which is unsuitable for cryptographic purposes.

JHipster versions below 6.3.0 (or JHipster Kotlin versions below and including 1.1.0) would generate a RandomUtil class that uses Apache's RandomStringUtils class insecurely, leading to generation of random data unsuitable for cryptographic purposes.

Bad Practice

This is an example of what a vulnerable RandomUtil class looks like:

import org.apache.commons.lang3.RandomStringUtils;

/**
 * Utility class for generating random Strings.
 */
public final class RandomUtil {

    private static final int DEF_COUNT = 20;

    private RandomUtil() {
    }

    /**
     * Generate a password.
     *
     * @return the generated password.
     */
    public static String generatePassword() {
        return RandomStringUtils.randomAlphanumeric(DEF_COUNT); // This call is not using SecureRandom and will generate predictable passwords.
    }

    // ...
}

Recommended

  • Upgrade to the latest version of JHipster if possible

You can find the latest JHipster version at their release page.

  • Modify the RandomUtil java file to fix the issue

This is a very simple way to fix the issue. To do so, replace the contents of the existing RandomUtil.java file with that of the one linked here. This fixed version uses an instance of java.security.SecureRandom to ensure that random numbers are securely generated.

References