Is CVE-2018-0114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-0114 being exploited in the wild.

How severe is CVE-2018-0114?

Low severity, with a CVSS score of 3.1, published 13 May 2022.

Which products and versions are affected?

node-jose (npm) SEMVER:introduced=0,fixed=0.11.0.

Is there a fix for CVE-2018-0114?

Yes. node-jose (npm): upgrade to 0.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-0114 attacked?

It is attacked over the network.

Am I affected by CVE-2018-0114?

Check whether you run node-jose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-0114: Cisco node-jose improper JWT signature validation

CVE-2018-0114 · Severity: low · CVSS 3.1 · Published 2022-05-13

Cisco node-jose is a JavaScript library used to sign and encrypt JSON Web Tokens (JWTs), which are commonly used for authentication in web applications. A vulnerability allows an attacker to forge valid authentication tokens by removing the original signature and embedding their own public key in the token header, bypassing authentication controls. An attacker could exploit this to gain unauthorized access to systems relying on this library for token validation.

Technologies: node-jose (npm). Vendors: npm.

Quick answers

Is CVE-2018-0114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-0114 being exploited in the wild.
How severe is CVE-2018-0114?: Low severity, with a CVSS score of 3.1, published 13 May 2022.
Which products and versions are affected?: node-jose (npm) SEMVER:introduced=0,fixed=0.11.0.
Is there a fix for CVE-2018-0114?: Yes. node-jose (npm): upgrade to 0.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-0114 attacked?: It is attacked over the network.
Am I affected by CVE-2018-0114?: Check whether you run node-jose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-jose (npm): upgrade to 0.11.0 or later
```
npm install node-jose@0.11.0
```

Technical details

The vulnerability is an improper validation of JWT signatures (CWE-347) in the Cisco node-jose library before version 0.11.0. The root cause is that the library follows the JWS standard which permits embedding a JSON Web Key (JWK) public key in the token header; node-jose improperly trusts this embedded key for verification without additional validation. An unauthenticated remote attacker can exploit this by crafting a malicious JWS object: remove the original signature, inject an attacker-controlled public key in the header, and re-sign using the corresponding private key. The attack requires network access to a system using the vulnerable library for JWT validation, but no authentication or user interaction. This allows complete forgery of authentication tokens. The vulnerability was fixed in version 0.11.0.

Affected products

Cisco node-jose before 0.11.0

Identifiers

CVE-2018-0114
GHSA-jfxm-w8g2-4rcv

Timeline

2018-01-04: disclosed
0.11.0: patched
2022-05-13: advisory

References

https://github.com/cisco/node-jose

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.