-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.syncope:syncope-core | maven | >= 4.0.0, < 4.0.3 | 4.0.3 |
| org.apache.syncope:syncope-core | maven | < 3.0.15 | 3.0.15 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because Apache Syncope used a hard-coded default AES key for encrypting sensitive data, such as user passwords, when AES encryption was enabled but no specific key was configured. An attacker with access to the database could easily decrypt this data using the known hard-coded key.
The analysis of the patches reveals that the core of the issue was in the org.apache.syncope.core.spring.security.Encryptor and org.apache.syncope.core.spring.security.DefaultEncryptor classes. These classes contained a hard-coded DEFAULT_SECRET_KEY that was used as a fallback. The getInstance methods in Encryptor and DefaultEncryptorManager were responsible for creating encryption instances, and they would use this default key if no other key was provided.
Several parts of the application, such as JPAUser.setPassword, called these encryption methods to protect sensitive information. The patches remove the hard-coded key and modify the logic to require that an AES key be explicitly configured in the application's properties (security.aesSecretKey). This ensures that all encrypted data uses a unique, user-defined key, mitigating the risk of trivial decryption by an attacker.
org.apache.syncope.core.spring.security.Encryptor.Encryptorcore/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java
org.apache.syncope.core.spring.security.Encryptor.getInstancecore/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java
org.apache.syncope.core.spring.security.DefaultEncryptor.DefaultEncryptorcore/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptor.java
org.apache.syncope.core.spring.security.DefaultEncryptorManager.getInstancecore/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptorManager.java
org.apache.syncope.core.persistence.jpa.entity.user.JPAUser.setPasswordcore/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPAUser.java