Signature Verification Bypass in jwt-simple
Summary
GHSA-8v5f-hp78-jgxq: Signature Verification Bypass in jwt-simple. Affects jwt-simple versions < 0.5.3. Fixed in 0.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jwt-simple package is an npm package used for decoding and verifying JSON Web Tokens (JWTs). It provides a simple and straightforward way to handle JWTs in Node.js applications. However, versions prior to 0.5.3 are vulnerable to a Signature Verification Bypass.
Vulnerability Detail
The vulnerability in jwt-simple arises when no algorithm is specified in the decode() function. In such cases, the package uses the algorithm specified in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as the secret. The package will then mistakenly verify it as HS256 instead of RS256 (asymmetric algorithm). This bypasses the signature verification process and allows the attacker to impersonate a valid user or perform unauthorized actions.
How To Fix
Minimum fixed version
0.5.3
This is the first release that contains the fix.
npm install jwt-simple@0.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to explicitly specify the algorithm (e.g., RS256) when calling the decode() function. This ensures that the correct algorithm is used for signature verification.
Conclusion
The jwt-simple package prior to version 0.5.3 is vulnerable to a Signature Verification Bypass. It is crucial to upgrade to the latest version or apply the recommended workaround to mitigate the risk of unauthorized access or impersonation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jwt-simple →
FAQ
This vulnerability allows an attacker to bypass signature verification in the jwt-simple package, potentially leading to unauthorized access or impersonation of valid users.
Versions prior to 0.5.3 of the jwt-simple package are affected by this vulnerability.
Yes, upgrading to version 0.5.3 or later of the jwt-simple package fixes this vulnerability.
Yes, a temporary workaround is to explicitly specify the algorithm (e.g., RS256) when calling the decode() function.
You can find more information about this vulnerability in the advisory published by the GitHub Security Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for jwt-simple.
