CVE-2016-10555: Forgeable Public/Private Tokens in jwt-simple
Summary
CVE-2016-10555: Forgeable Public/Private Tokens in jwt-simple. Affects jwt-simple versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jwt-simple package is an npm package used for encoding and decoding JSON Web Tokens (JWTs). JWTs are a popular method for securely transmitting information between parties as a JSON object. The jwt-simple package provides a simple and convenient way to work with JWTs in Node.js applications.
Vulnerability Detail
Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. This behavior can be exploited by a malicious actor to modify the contents of a JWT while still passing verification. This vulnerability can lead to a complete authentication bypass, allowing unauthorized access to protected resources. The vulnerability is classified as critical (CWE-20).
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
npm install jwt-simple@0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The jwt-simple package is vulnerable to a critical authentication bypass vulnerability. To mitigate this vulnerability, it is crucial to update to version 0.3.1 or later and always specify a secure algorithm when decoding JWTs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jwt-simple →
FAQ
The impact of this vulnerability is an authentication bypass, allowing unauthorized access to protected resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities in real-time.
No, only versions prior to 0.3.1 are affected. It is recommended to update to version 0.3.1 or later to fix the vulnerability.
Here is an example of how the vulnerability can be exploited:
const jwt = require('jwt-simple');
const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.5JZcQ5YyGZ4e2K2r6QJv7w';
const payload = jwt.decode(token);
payload.name = 'Admin';
const modifiedToken = jwt.encode(payload, 'weaksecret');
console.log(modifiedToken);
In this example, the attacker modifies the payload of the JWT and then re-encodes it using a weak secret. The modified token will still pass verification, allowing the attacker to impersonate an admin user.
You can find more information about this vulnerability in the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-vgrx-w6rg-8fqf/GHSA-vgrx-w6rg-8fqf.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for jwt-simple.
