Quick answers
- Is CVE-2016-10555 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-10555 being exploited in the wild.
- How severe is CVE-2016-10555?
- Informational severity, with a CVSS score of 9.1, published 6 November 2018.
- Which products and versions are affected?
- jwt-simple (npm) < 0.3.1.
- Is there a fix for CVE-2016-10555?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2016-10555 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-10555?
- Check whether you run jwt-simple (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from a CWE-20 improper input validation issue where jwt-simple allows the algorithm specified in the JWT itself (rather than a fixed server-side algorithm) to be used during verification. An attacker can craft a JWT with an arbitrary algorithm claim and provide corresponding "signed" content that passes verification under that algorithm, allowing them to forge authentication tokens. The attack requires no authentication but does require knowledge of the application's verification flow. The vulnerability affects all versions prior to 0.3.1; patched versions introduced a verify() method that requires explicit algorithm specification on the server side to prevent algorithm confusion attacks.
Affected products
- npm jwt-simple < 0.3.1
Identifiers
- CVE-2016-10555
- GHSA-vgrx-w6rg-8fqf
Timeline
- 2015-03-31: disclosed: Auth0 published critical JWT library vulnerabilities research
- 2018-11-06: advisory: GHSA-vgrx-w6rg-8fqf published
- 2016: other: CVE-2016-10555 assigned