Improper Input Validation Affecting json-web-token package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSONWEBTOKEN-6069816
- published 19 Nov 2023
- disclosed 17 Nov 2023
- credit PinkDraconian
Introduced: 17 Nov 2023
CVE-2023-48238 Open this link in a new tabHow to fix?
There is no fixed version for json-web-token.
Overview
json-web-token is a JSON Web Token (JWT) is a compact token format intended for space constrained environments such as HTTP Authorization headers and URI query parameters.
Affected versions of this package are vulnerable to Improper Input Validation due to improper signature verification of the JWA token, allowing an attacker to exploit this vulnerability by crafting a malicious JWT token containing the HS256 algorithm signed with the public RSA key of the victim application. This is only exploitable if the RS256 algorithm is in use.
Workaround
Either one of the following solutions will work.
Change the signature of the decode function to ensure that the algorithm is set in that call.
Check whether or not the secret could be a public key in the decode function, and in that case, set the key to be a public key.