CVE-2022-3102: jwcrypto Authentication Bypass via Token Substitution
Summary
CVE-2022-3102: jwcrypto token substitution can lead to authentication bypass. Affects jwcrypto versions < 1.4. Fixed in 1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jwcrypto is a Python library that provides tools for creating and verifying JSON Web Tokens (JWTs). It supports various token types, including JWS (JSON Web Signature) and JWE (JSON Web Encryption). This library is widely used for secure token-based authentication in web applications. However, it has a vulnerability that can lead to authentication bypass under specific conditions, particularly when the application mishandles token validation.
Vulnerability Detail
The vulnerability arises from the ability of the JWT code to auto-detect the type of token being provided. An attacker can exploit this by substituting a signed JWS with a JWE encrypted with the public key used for signature validation. If the validating application has access to the private key used for signing, it may incorrectly trust the JWE, leading to potential authentication or authorization bypass. This is particularly concerning as the attacker can inject any claim value into the JWE, compromising the integrity of the authentication process.
How To Fix
Minimum fixed version
1.4
This is the first release that contains the fix.
pip install --upgrade "jwcrypto==1.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the private key corresponding to the public key used for encrypting the JWE is not accessible to the application. Additionally, specify the JWK with the 'use' parameter set to 'sig' and ensure that the 'key_ops' parameter does not include the 'decrypt' operation. This will raise exceptions for invalid token types.
Conclusion
CVE-2022-3102 is a moderate severity vulnerability in the jwcrypto library that can lead to authentication bypass through token substitution. It is crucial for developers using this library to update to the patched version and implement recommended workarounds to secure their applications against potential exploitation.
See every vulnerability recorded for jwcrypto →
FAQ
The main risk is an authentication bypass, allowing attackers to impersonate users or gain unauthorized access to resources by manipulating token claims.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement the suggested workarounds, such as restricting access to the private key and properly configuring JWK parameters to prevent exploitation.
While this specific vulnerability is related to jwcrypto, similar issues can occur in other libraries that handle JWTs improperly. Always review library documentation and security advisories.
The vulnerability was reported by Tom Tervoort of Secura, highlighting the importance of community vigilance in maintaining software security.
References
Related vulnerabilities
Recent vulnerabilities recorded for jwcrypto.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.