Executive brief
hapi-auth-jwt2 is a Node.js library that authenticates requests using JWT (JSON Web Tokens) for the hapi web framework. A vulnerability in try authentication mode allows attackers to bypass authentication entirely, causing the application to treat unauthenticated requests as if they were successfully authenticated. This could lead to unauthorized access to protected resources and sensitive data exposure.
Technical details
The vulnerability is an authentication bypass (CWE-287) affecting hapi-auth-jwt2 versions prior to 5.1.2, specifically when the plugin is configured in try authentication mode. In this mode, instead of rejecting requests without valid JWT credentials, the plugin incorrectly sets request.auth.isAuthenticated to true and request.auth.credentials to an empty object {} for unauthenticated requests. The attack requires no authentication, no special privileges, and can be exploited over the network by simply making requests without valid JWT tokens. An attacker can gain unauthorized access to protected routes that rely on this authentication check. The fix is to update to version 5.1.2 or later.
Affected products
- dwyl hapi-auth-jwt2 before 5.1.2
Timeline
- 2015-10-14: disclosed
- 2019-02-18: advisory
- 2015: patched: Fixed in version 5.1.2