CVE-2020-26160: Authorization bypass in github.com/dgrijalva/jwt-go
Summary
CVE-2020-26160: Authorization bypass in github.com/dgrijalva/jwt-go. Affects github.com/dgrijalva/jwt-go versions >= 0.0.0-20150717181359-44718f8a89b0. No fix is published. How to fix ↓
Also tracked for
- golang-github-dgrijalva-jwt-go · Debian:11
The same CVE-2020-26160 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/dgrijalva/jwt-go is a Go implementation of JSON Web Tokens (JWT). It provides functionality for creating, signing, and verifying JWTs. JWTs are used for securely transmitting information between parties as a JSON object. This package is widely used in Go applications for implementing authentication and authorization mechanisms.
Vulnerability Detail
The vulnerability (CVE-2020-26160) in github.com/dgrijalva/jwt-go allows an attacker to bypass authorization checks if a JWT contains an audience claim with an array of strings instead of a single string. When the MapClaims.VerifyAudience function is called with the 'req' parameter set to false, the audience verification is bypassed, allowing an invalid set of audiences to be provided. This can lead to unauthorized access and privilege escalation in affected applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the package.
Conclusion
The vulnerability (CVE-2020-26160) in github.com/dgrijalva/jwt-go allows for authorization bypass, potentially leading to unauthorized access and privilege escalation. It is recommended to upgrade to version 4.0.0-preview1 of github.com/dgrijalva/jwt-go/v4 to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/dgrijalva/jwt-go →
FAQ
This vulnerability allows an attacker to bypass authorization checks, potentially leading to unauthorized access and privilege escalation in affected applications.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and alerts you in real-time for open-source vulnerabilities.
Yes, the vulnerability has been fixed in version 4.0.0-preview1 of github.com/dgrijalva/jwt-go/v4. It is recommended to upgrade to this version to mitigate the vulnerability.
There are no known workarounds for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the package.
You can find more information about this vulnerability in the CVE-2020-26160 entry on the VulnDB database (https://vuln.go.dev/ID/GO-2020-0017.json).
