Executive brief
The jws library, used to create and verify JSON Web Tokens (JWTs) in Node.js applications, contains a vulnerability that allows attackers to forge authentication tokens. An attacker can modify the contents of a JWT while still passing verification, leading to complete authentication bypass in systems relying on JWTs as bearer tokens. This could result in unauthorized access to protected resources and data.
Technical details
The vulnerability is an algorithm confusion weakness in the jws library's JWT verification logic. The vulnerable versions allow callers to specify the algorithm to use for verification, enabling an attacker to arbitrarily modify JWT claims and recompute a valid signature that will be accepted by the verifier. This occurs because the library did not enforce a required algorithm parameter, instead trusting the "alg" field in the JWT header supplied by an attacker. The fix (version 3.0.0 and later) makes the algorithm parameter mandatory and ignores the "alg" field from untrusted JWT headers. The attack requires only network access to a service using jws for JWT verification and no authentication preconditions.
Affected products
- npm jws < 3.0.0
Timeline
- 2020-09-01: disclosed
- 2015-04: patched: Fix released in version 3.0.0