Rapid7 Nexpose Insecure Java Keystore Password Generation

Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.

N/A

信息熵不充分

Rapid7 Nexpose 安全漏洞

Rapid7 Nexpose是美国Rapid7公司的一套能够利用扫描结果深度探测网络的漏洞管理软件。该软件支持扫描配置环境的错误、漏洞、恶意软件等。 Rapid7 Nexpose 6.4.50及之后版本存在安全漏洞，该漏洞源于CredentialsKeyStorePassword.generateRandomPassword方法熵不足，生成弱密码，可能导致攻击者暴力破解并解密存储的凭据。

N/A

N/A