-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.streampark:streampark | maven | >= 2.0.0, < 2.1.7 | 2.1.7 |
Miggo AIRoot Cause AnalysisThe vulnerability is rooted in the org.apache.streampark.console.base.util.EncryptUtils class, which was responsible for encryption and decryption operations. The analysis of the patch 39034db0c806168afa82e58e4f376e1e3c3b73e4 reveals that this class was entirely removed. The core issue lies in the getCipher method within this class. It initialized an AES cipher by calling Cipher.getInstance("AES") without specifying a block cipher mode of operation. This causes the JCE provider to default to AES/ECB/PKCS5Padding, where ECB (Electronic Codebook) mode is known to be insecure because it encrypts identical blocks of plaintext into identical blocks of ciphertext, revealing patterns in the data. Additionally, it used SecureRandom.getInstance("SHA1PRNG"), a weak pseudo-random number generator, for generating the encryption key.
The vulnerable EncryptUtils.encrypt and EncryptUtils.decrypt functions were used in critical parts of the authentication flow. Specifically, JWTUtil.sign called EncryptUtils.encrypt to protect the JWT token, and JWTFilter.executeLogin called EncryptUtils.decrypt to process the incoming token. This means that the JWT tokens, which are used for user authentication, were protected by weak cryptography, potentially allowing an attacker to decrypt them or forge valid tokens.
The patch remediates this by removing the EncryptUtils class and replacing it with a new, more secure implementation within JWTUtil. The new implementation uses AES/GCM/NoPadding, which is an authenticated encryption mode that provides both confidentiality and integrity, and a strong, properly seeded random number generator for the initialization vector (IV).
org.apache.streampark.console.base.util.EncryptUtils.encryptstreampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/EncryptUtils.java
org.apache.streampark.console.base.util.EncryptUtils.decryptstreampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/EncryptUtils.java
org.apache.streampark.console.base.util.EncryptUtils.getCipherstreampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/EncryptUtils.java
org.apache.streampark.console.system.authentication.JWTFilter.executeLoginstreampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/authentication/JWTFilter.java
org.apache.streampark.console.system.authentication.JWTUtil.signstreampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/authentication/JWTUtil.java
A Semantic Attack on Google Gemini - Read the Latest Research