CVE-2020-15084: Authorization bypass in express-jwt
Summary
CVE-2020-15084: Authorization bypass in express-jwt. Affects express-jwt versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is express-jwt, an npm package used for handling JSON Web Tokens (JWT) in Express.js applications. It provides middleware to authenticate and authorize requests based on JWTs. The package allows developers to specify various configurations, including algorithms for token verification. However, versions before and including 5.3.3 do not enforce the 'algorithms' entry to be specified in the configuration. This vulnerability can lead to authorization bypass when 'algorithms' is not configured and libraries like jwks-rsa are used as the secret.
Vulnerability Detail
The vulnerability (CVE-2020-15084) arises from the lack of enforcement of the 'algorithms' configuration in express-jwt. Without specifying 'algorithms', an attacker can bypass authorization when using libraries like jwks-rsa as the secret. This can have severe consequences, as unauthorized users may gain access to restricted resources or perform actions they are not allowed to. The vulnerability has a CVSS score of 7.7, indicating a high severity level.
How To Fix
Minimum fixed version
6.0.0
This is the first release that contains the fix.
npm install express-jwt@6.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the express-jwt package versions before and including 5.3.3 are vulnerable to an authorization bypass issue when 'algorithms' is not configured. To mitigate this vulnerability, it is crucial to update the package to version 6.0.0 or later and specify the 'algorithms' configuration. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for express-jwt →
FAQ
You are affected if you are using express-jwt, do not have 'algorithms' configured in your express-jwt configuration, and are using libraries like jwks-rsa as the secret.
You can fix this vulnerability by specifying 'algorithms' in the express-jwt configuration. Refer to the 'how_to_fix' section for an example configuration.
The fix provided in the patch will not affect your users if you have already specified the allowed algorithms. The patch makes 'algorithms' a required configuration, ensuring the vulnerability is addressed.
The severity of this vulnerability is rated as high, with a CVSS score of 7.7.
This vulnerability was discovered by the IST Group.
