Signature Verification Bypass

Affecting jwt-simple package, versions <0.5.3

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

jwt-simple is a JWT(JSON Web Token) encode and decode module.

Affected versions of this package are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).

Remediation

Upgrade jwt-simple to version 0.5.3 or higher.

References

CVSS Score

5.3
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credit
Daniel Gunawan
CWE
CWE-358
Snyk ID
SNYK-JS-JWTSIMPLE-174523
Disclosed
24 Apr, 2019
Published
25 Apr, 2019