Critical Vulnerability in firebase/php-jwt: "None" Algorithm Treated as Valid on Tokens
Summary
GHSA-h533-5v22-8vcp: firebase/php-jwt: "None" Algorithm treated as valid on tokens. Affects firebase/php-jwt versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
firebase/php-jwt is a widely-used JSON Web Token (JWT) library for PHP. It provides functionality for encoding, decoding, and verifying JWTs. JWTs are used for securely transmitting information between parties as a JSON object. The library supports various algorithms for signing and verifying JWTs, including asymmetric keys. However, a critical vulnerability has been discovered in versions prior to 2.0.0, where the "None" algorithm is treated as valid on tokens. This vulnerability affects the security of JWT verification and can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from a flaw in the library's handling of asymmetric keys. When using algorithms such as RS256, RS384, RS512, ES256, ES384, or ES512, the library fails to properly verify the algorithm specified in the token header. As a result, an attacker can craft a token with the "None" algorithm, which should be considered invalid, but will be treated as valid by the library. This bypasses the verification step and allows the attacker to impersonate a legitimate user or gain unauthorized access to protected resources.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require firebase/php-jwt:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the library to mitigate the risk.
Conclusion
In conclusion, the firebase/php-jwt library is affected by a critical vulnerability that allows the "None" algorithm to be treated as valid on tokens. This can lead to unauthorized access and impersonation attacks. It is crucial to update to version 2.0.0 or later of the library to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for firebase/php-jwt →
FAQ
firebase/php-jwt is a PHP library for working with JSON Web Tokens (JWTs). It provides functionality for encoding, decoding, and verifying JWTs.
This vulnerability allows attackers to bypass the verification step when using certain asymmetric key algorithms. They can impersonate legitimate users or gain unauthorized access to protected resources.
Versions prior to 2.0.0 of firebase/php-jwt are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the fixed version of the library is necessary.
To fix this vulnerability, upgrade to version 2.0.0 or later of the firebase/php-jwt library.
References
Related vulnerabilities
Recent vulnerabilities recorded for firebase/php-jwt.
