CVE-2020-26160: Authorization bypass in github.com/dgrijalva/jwt-go

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The package github.com/dgrijalva/jwt-go is a Go implementation of JSON Web Tokens (JWT). It provides functionality for creating, parsing, and validating JWTs. JWTs are used for securely transmitting information between parties as a JSON object. This package is vulnerable to an authorization bypass issue that allows attackers to bypass intended access restrictions.

Vulnerability Detail

The vulnerability in jwt-go arises when the "aud" (audience) claim in the JWT token is of type []string{} (an empty string array), which is allowed by the specification. Due to a type assertion failure, the value of "aud" becomes an empty string (""). This can be a security problem if the JWT token is presented to a service that lacks its own audience check. An attacker can craft a JWT token with an empty audience claim and bypass access restrictions, potentially gaining unauthorized access to protected resources.

Workaround

If migration to golang-jwt is not feasible, a workaround for this vulnerability is to manually check the audience claim in the JWT token before processing it. This can be done by inspecting the value of the "aud" claim and ensuring it is not an empty string. Here is an example of how to perform this check in Go:

import (
	"github.com/dgrijalva/jwt-go"
	"fmt"
)

func validateJWT(tokenString string) error {
	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
		return []byte("secret"), nil
	})
	if err != nil {
		return err
	}

	if claims, ok := token.Claims.(jwt.MapClaims); ok {
		aud, ok := claims["aud"].([]string)
		if !ok || len(aud) == 0 || aud[0] == "" {
			return fmt.Errorf("Invalid audience claim")
		}
	}

	return nil
}

Conclusion

The vulnerability in github.com/dgrijalva/jwt-go allows attackers to bypass access restrictions by crafting a JWT token with an empty audience claim. To mitigate this vulnerability, users are advised to migrate to golang-jwt at version 3.2.1 or later. Alternatively, a workaround is available by manually checking the audience claim in the JWT token. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/dgrijalva/jwt-go →

FAQ