Executive brief
jwt-simple is a Node.js library for creating and verifying JSON Web Tokens (JWTs), which are used for authentication in web applications. The library allows an attacker to arbitrarily modify JWT contents and forge valid tokens by exploiting algorithm selection behavior, resulting in complete authentication bypass with minimal effort.
Technical details
The vulnerability stems from a CWE-20 improper input validation issue where jwt-simple allows the algorithm specified in the JWT itself (rather than a fixed server-side algorithm) to be used during verification. An attacker can craft a JWT with an arbitrary algorithm claim and provide corresponding "signed" content that passes verification under that algorithm, allowing them to forge authentication tokens. The attack requires no authentication but does require knowledge of the application's verification flow. The vulnerability affects all versions prior to 0.3.1; patched versions introduced a verify() method that requires explicit algorithm specification on the server side to prevent algorithm confusion attacks.
Affected products
- npm jwt-simple < 0.3.1
Timeline
- 2015-03-31: disclosed: Auth0 published critical JWT library vulnerabilities research
- 2018-11-06: advisory: GHSA-vgrx-w6rg-8fqf published
- 2016: other: CVE-2016-10555 assigned