CVE-2020-10594: Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Summary
CVE-2020-10594: Django Rest Framework jwt allows obtaining new token from notionally invalidated token. Affects drf-jwt versions >= 1.15.0, < 1.15.1. Fixed in 1.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django Rest Framework jwt is a package that provides JSON Web Token authentication support for Django REST Framework. It allows users to authenticate and authorize requests using JWT tokens. This vulnerability affects versions 1.15.x before 1.15.1 of the package. The package is a fork of jpadilla/django-rest-framework-jwt, which is no longer maintained.
Vulnerability Detail
The vulnerability (CVE-2020-10594) allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint. This is possible because the blacklist protection mechanism is incompatible with the token-refresh feature. The issue arises due to a flaw in the check_payload function of the rest_framework_jwt.utils module. An attacker can exploit this vulnerability to bypass token invalidation and gain unauthorized access to the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
How To Fix
Minimum fixed version
1.15.1
This is the first release that contains the fix.
pip install --upgrade "drf-jwt==1.15.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
In conclusion, the CVE-2020-10594 vulnerability in drf-jwt allows attackers to obtain new tokens from notionally invalidated tokens, bypassing token invalidation and gaining unauthorized access to the system. Users should upgrade to version 1.15.1 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for drf-jwt →
FAQ
Drf-jwt is a package that provides JSON Web Token authentication support for Django REST Framework.
This vulnerability allows attackers to obtain new, working tokens from notionally invalidated tokens, bypassing token invalidation and gaining unauthorized access to the system.
To fix this vulnerability, upgrade to version 1.15.1 or later of drf-jwt.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
