[CB-3681] Use something better than MD5 hash to pass local user passwords #3776

sergeyteleshev · 2025-09-24T16:15:22Z

closes https://github.com/dbeaver/pro/issues/4569

…cases

…hash-to-pass-local-user-passwords

…r-than-md5-hash-to-pass-local-user-passwords' into 4569-cb-3681-use-something-better-than-md5-hash-to-pass-local-user-passwords

…hash-to-pass-local-user-passwords

webapp/packages/core-utils/src/createHash.ts

+    return hash.toUpperCase();
+  }
+
+  return md5(value).toUpperCase();


In general, to fix the use of an insufficiently strong hash (like SHA-256 or MD5) for password hashing, we must replace them with a secure, computationally expensive, and salted password-hashing algorithm. In the JavaScript/TypeScript ecosystem, the most common and well-supported options are bcrypt, scrypt, or PBKDF2—bcrypt is especially simple and robust.

For this project, the change should be limited to only the relevant password-flows, so existing generic hashing functionality (e.g., for checksums, not password hashing) is preserved. You should create a new utility function—such as hashPassword—that uses bcrypt, and replace the problematic use of createHash with a call to the new function where passwords are being hashed (i.e., in UserInfoResource.ts, method updateLocalPassword). Update imports accordingly. Since bcrypt is an external dependency, add the import at the top of the relevant file. You do not need to change the general createHash function, unless you know it is used exclusively for password hashing (which, based on its name and structure, it is not).

Specifically:

In UserInfoResource.ts, define and use a secure password hashing function (bcrypt.hashSync or the async version).

Add required bcrypt import.

Use this new function to hash oldPassword and newPassword in updateLocalPassword, instead of using createHash.

You may need to set a salt rounds constant (recommended: 12).

…hash-to-pass-local-user-passwords

…r-than-md5-hash-to-pass-local-user-passwords' into 4569-cb-3681-use-something-better-than-md5-hash-to-pass-local-user-passwords

…hash-to-pass-local-user-passwords

…ased in UI

serge-rider · 2025-10-06T15:03:41Z

...dbeaver.service.security/src/io/cloudbeaver/service/security/bruteforce/BruteForceUtils.java

    private static final Log log = Log.getLog(BruteForceUtils.class);

-    public static void checkBruteforce(SMControllerConfiguration smConfig, List<UserLoginRecord> latestLoginAttempts)
+    public static void checkBruteforce(SMControllerConfiguration smConfig, List<UserLoginRecord> latestLoginAttempts,


Annotations + code style

serge-rider · 2025-10-06T15:03:53Z

...ndles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/db/CBDatabase.java

            Map<String, Object> credentials = new LinkedHashMap<>();
            credentials.put(LocalAuthProviderConstants.CRED_USER, adminUser.getUserId());
-            credentials.put(LocalAuthProviderConstants.CRED_PASSWORD, clientPassword);
+            credentials.put(LocalAuthProviderConstants.CRED_PASSWORD, adminPassword);


Why remove digest?

serge-rider · 2025-10-06T15:04:10Z

server/test/io.cloudbeaver.test.platform/workspace/conf/initial-data.conf

 {
    adminName: "test",
-    adminPassword: "test",
+    adminPassword: "9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08",


Why store digest but password?

serge-rider · 2025-10-06T15:05:12Z

...o.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java

+
+    private void validatePasswordSha(String passwordSha, Map<String, Object> storedCredentials) throws DBException {
+        try {
+            if (!Argon2IdHasher.verify(CommonUtils.toString(storedCredentials.get(LocalAuthProviderConstants.CRED_PASSWORD)), passwordSha)) {


Let's move all game with argon inside security utils. We mustn't know what algorithms are used on this level of abstraction.

serge-rider · 2025-10-06T15:07:28Z

server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/UserLoginRecord.java

-public record UserLoginRecord(SMAuthStatus smAuthStatus, LocalDateTime time) {
+public record UserLoginRecord(SMAuthStatus smAuthStatus,
+    LocalDateTime time,
+    Map<String, Object> authState


Not sure that it is safe to read auth state. What changed, why do we need it now?

serge-rider · 2025-10-06T15:07:56Z

...o.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java

    public static final String CRED_PASSWORD = LocalAuthProviderConstants.CRED_PASSWORD;
+    public static final String AUTH_LOCAL_TYPE = "authLocalType";
+    public static final String LEGACY_AUTH_LOCAL_TYPE = "legacy";
+    public static final String NEW_AUTH_LOCAL_TYPE = "new";


let's name it sha

serge-rider · 2025-10-06T15:08:25Z

...o.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java


    public static final String PROVIDER_ID = LocalAuthProviderConstants.PROVIDER_ID;
    public static final String CRED_USER = LocalAuthProviderConstants.CRED_USER;
+    public static final String CRED_PASSWORD_MD_5 = LocalAuthProviderConstants.CRED_PASSWORD_MD5;


Wroud · 2025-10-07T17:04:37Z

webapp/packages/plugin-authentication/src/Dialog/useAuthDialogState.ts

            await authInfoService.login(provider.id, {
              configurationId: configuration?.id,
              credentials: {
                ...state.credentials,
                credentials: {
                  ...state.credentials.credentials,
                  user: state.credentials.credentials['user']?.trim(),
                  password: state.credentials.credentials['password']?.trim(),
                },
              },
              forceSessionsLogout: state.forceSessionsLogout,
              linkUser,
            });


wrap this block with additional try/catch
if it's shouldReloginWithOldHash than run

await authInfoService.login(provider.id, { configurationId: configuration?.id, credentials: { ...state.credentials, credentials: { ...state.credentials.credentials, user: state.credentials.credentials['user']?.trim(), password: state.credentials.credentials['password']?.trim(), }, }, forceSessionsLogout: state.forceSessionsLogout, linkUser, });

again in catch block, if it throws - higher catch will get exception and handle it properly

Wroud · 2025-10-07T17:05:04Z

webapp/packages/plugin-authentication/src/Dialog/useAuthDialogState.ts

+          if (shouldReloginWithOldHash) {
+            try {
+              await authInfoService.login(provider.id, {
+                configurationId: configuration?.id,
+                credentials: {
+                  ...state.credentials,
+                  credentials: {
+                    ...state.credentials.credentials,
+                    user: state.credentials.credentials['user']?.trim(),
+                    password: state.credentials.credentials['password']?.trim(),
+                  },
+                },
+                forceSessionsLogout: state.forceSessionsLogout,
+                linkUser,
+                hasOldHash: true,
+              });
+            } catch {}
+          }


remove to upper place without try/catch as described above

…hash-to-pass-local-user-passwords

sergeyteleshev added 3 commits September 24, 2025 17:03

dbeaver/pro#4569 adds sha256 algorithm

4ea73f5

adds sha256 hashes for passwords and todos to user login/create/edit …

b982e64

…cases

removes lib for sha256

3ef71c4

sergeyteleshev assigned sergeyteleshev and HocKu7 Sep 24, 2025

sergeyteleshev and others added 20 commits September 29, 2025 09:52

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

762a9f4

…hash-to-pass-local-user-passwords

adds rehash logic for changePassword in User Profile

82cb6d1

sends firstly sha256 for user profile. then md5

48783fa

fix for new password

397601d

adds sha256 for login

13ee9bd

sends md5 pass on second login

25ca346

attempts relogin on

fa60145

dbeaver/pro#4569 change md5 hashing

a13c2f9

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

314028e

…hash-to-pass-local-user-passwords

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

1e843c6

…hash-to-pass-local-user-passwords

dbeaver/pro#4569 bruteforce

1e89891

dbeaver/pro#4569 fixing tests

166fb05

dbeaver/pro#4569 fix tests

621884a

fixes second attempt to send md5 on login

7de53be

cleanup

def3af7

sends only sha256 password for update local password action

5342160

dbeaver/pro#4569 fix bruteforce policy

4bda427

Merge remote-tracking branch 'origin/4569-cb-3681-use-something-bette…

5e7d898

…r-than-md5-hash-to-pass-local-user-passwords' into 4569-cb-3681-use-something-better-than-md5-hash-to-pass-local-user-passwords

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

9bee2b9

…hash-to-pass-local-user-passwords

unifies creating hash + fixes create user password

626b5e8

github-advanced-security bot found potential problems Oct 2, 2025

View reviewed changes

sergeyteleshev and others added 4 commits October 2, 2025 19:56

cleanup

d34f158

dbeaver/pro#4569 fixes

976993b

dbeaver/pro#4569 fixes

7219ebc

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

b6a5574

…hash-to-pass-local-user-passwords

HocKu7 and others added 4 commits October 6, 2025 14:12

dbeaver/pro#4569 fixes

0db5d7a

Merge remote-tracking branch 'origin/4569-cb-3681-use-something-bette…

b353027

…r-than-md5-hash-to-pass-local-user-passwords' into 4569-cb-3681-use-something-better-than-md5-hash-to-pass-local-user-passwords

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

dfdfcd2

…hash-to-pass-local-user-passwords

fix: relogins only on invalid creds error so other errors are not err…

525332e

…ased in UI

HocKu7 marked this pull request as ready for review October 6, 2025 14:58

serge-rider requested changes Oct 6, 2025

View reviewed changes

sergeyteleshev requested review from SychevAndrey, Wroud and devnaumov October 7, 2025 08:30

SychevAndrey previously approved these changes Oct 7, 2025

View reviewed changes

Wroud requested changes Oct 7, 2025

View reviewed changes

moves relogin logic to upper level

a41f8ce

sergeyteleshev dismissed SychevAndrey’s stale review via a41f8ce October 7, 2025 18:42

Merge branch 'devel' into 4569-cb-3681-use-something-better-than-md5-…

a816395

…hash-to-pass-local-user-passwords

@@ -6,6 +6,7 @@
              * you may not use this file except in compliance with the License.
              */
             import { computed, makeObservable, runInAction } from 'mobx';
+            import bcrypt from 'bcryptjs';
             import { injectable } from '@cloudbeaver/core-di';
             import { AutoRunningTask, type ISyncExecutor, type ITask, SyncExecutor, whileTask } from '@cloudbeaver/core-executor';
@@ -19,6 +20,13 @@
             import type { IAuthCredentials } from './IAuthCredentials.js';
             import { createHash } from '@cloudbeaver/core-utils';
+            // Secure password hashing function for user passwords
+            async function hashPassword(password: string): Promise<string> {
+              const SALT_ROUNDS = 12;
+              return await bcrypt.hash(password, SALT_ROUNDS);
+            }
             export type UserLogoutInfo = AuthLogoutQuery['result'];
             export interface ILoginOptions {
@@ -236,7 +244,10 @@
               async updateLocalPassword(oldPassword: string, newPassword: string): Promise<void> {
                 await this.performUpdate(undefined, [], async () => {
-                  const [oldPasswordHash, newPasswordHash] = await Promise.all([createHash(oldPassword, 'sha256'), createHash(newPassword, 'sha256')]);
+                  const [oldPasswordHash, newPasswordHash] = await Promise.all([
+                    hashPassword(oldPassword),
+                    hashPassword(newPassword),
+                  ]);
                   await this.graphQLService.sdk.authChangeLocalPassword({
                     oldPassword: oldPasswordHash,

@@ -37,7 +37,8 @@
                 "@cloudbeaver/core-utils": "workspace:*",
                 "@dbeaver/js-helpers": "workspace:*",
                 "mobx": "^6",
-                "tslib": "^2"
+                "tslib": "^2",
+                "bcryptjs": "^3.0.2"
               },
               "devDependencies": {
                 "@cloudbeaver/core-cli": "workspace:*",

Package	Version	Security advisories
bcryptjs (npm)	3.0.2	None

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[CB-3681] Use something better than MD5 hash to pass local user passwords #3776

[CB-3681] Use something better than MD5 hash to pass local user passwords #3776

sergeyteleshev commented Sep 24, 2025

Uh oh!

Check failure

Copilot Autofix

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

serge-rider Oct 6, 2025

Uh oh!

Wroud Oct 7, 2025

Uh oh!

Wroud Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

[CB-3681] Use something better than MD5 hash to pass local user passwords #3776

Are you sure you want to change the base?

[CB-3681] Use something better than MD5 hash to pass local user passwords #3776

Conversation

sergeyteleshev commented Sep 24, 2025

Uh oh!

Check failure

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants