Listen to this Post
How the CVE Works:
The vulnerability (CWE-470) occurs in `generator-jhipster-entity-audit` when Javers is selected as the Entity Audit Framework. Attackers can exploit unsafe reflection in JaversEntityAuditResource.java, where user-controlled input (entityType and qualifiedName) directly loads classes without proper validation. If an attacker injects a malicious class into the classpath and accesses the REST endpoints, they can trigger remote code execution (RCE). This requires ADMIN privileges but poses critical risk if exploited.
DailyCVE Form:
Platform: generator-jhipster-entity-audit
Version:
Vulnerability: Unsafe Reflection
Severity: Critical
Date: Apr 4, 2025
What Undercode Say:
Exploitation:
1. Malicious Class Injection:
Compile malicious payload javac EvilClass.java -d /target/classpath/
2. Exploit via REST:
POST /api/javers-audit/entity-type
Content-Type: application/json
{"entityType":"malicious.EvilClass"}
Mitigation:
1. Input Validation:
// Whitelist allowed classes
private static final Set<String> ALLOWED_CLASSES = Set.of("com.example.SafeClass");
if (!ALLOWED_CLASSES.contains(entityType)) throw new SecurityException();
2. Patch Upgrade:
npm update generator-jhipster-entity-audit --latest
3. Access Control:
application.yml security: roles: ADMIN: restricted
Detection:
1. Log Analysis:
grep -r "JaversEntityAuditResource" /var/log/app/
2. Classpath Audit:
find /app/lib -name ".class" | xargs file
References:
References:
Reported By: https://github.com/advisories/GHSA-7rmp-3g9f-cvq8
Extra Source Hub:
Undercode
