CVE-2015-9235: Verification Bypass in jsonwebtoken
Summary
CVE-2015-9235: Verification Bypass in jsonwebtoken. Affects jsonwebtoken versions < 4.2.2. Fixed in 4.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'jsonwebtoken' package is an npm package that provides functionality for creating, signing, and verifying JSON Web Tokens (JWTs). JWTs are used for secure transmission of information between parties. The package is widely used in various applications for authentication and authorization purposes.
Vulnerability Detail
Versions 4.2.1 and earlier of 'jsonwebtoken' are affected by a verification bypass vulnerability. This vulnerability stems from weak validation of the JWT algorithm type, allowing an attacker to specify the algorithm arbitrarily. As a result, an attacker can craft a malicious JWT with a manipulated algorithm, bypassing the verification process and potentially gaining unauthorized access or impersonating other users.
How To Fix
Minimum fixed version
4.2.2
This is the first release that contains the fix.
npm install jsonwebtoken@4.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The 'jsonwebtoken' package versions 4.2.1 and earlier are vulnerable to a verification bypass vulnerability. To mitigate the risk, it is crucial to update to version 4.2.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsonwebtoken →
FAQ
The vulnerability allows an attacker to bypass JWT verification, potentially leading to unauthorized access or impersonation of other users.
Versions 4.2.1 and earlier of 'jsonwebtoken' are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
No, there is no known workaround. Updating to the fixed version is necessary.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-c7hr-j4mj-j2w6/GHSA-c7hr-j4mj-j2w6.json
References
Related vulnerabilities
Recent vulnerabilities recorded for jsonwebtoken.
