Is CVE-2022-23540 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23540 being exploited in the wild.

How severe is CVE-2022-23540?

Low severity, with a CVSS score of 3.1, published 22 December 2022.

Which products and versions are affected?

jsonwebtoken (npm) SEMVER:introduced=0,fixed=9.0.0.

Is there a fix for CVE-2022-23540?

Yes. jsonwebtoken (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23540 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-23540?

Check whether you run jsonwebtoken (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23540: Auth0 jsonwebtoken signature validation bypass via default algorithm

CVE-2022-23540 · Severity: low · CVSS 3.1 · Published 2022-12-22

Auth0's jsonwebtoken library is used to verify digital signatures on JSON Web Tokens, which are commonly used for authentication in web applications and APIs. Versions up to 8.5.1 contain a flaw where the library defaults to accepting unsigned tokens when no algorithm is explicitly specified and a weak or missing secret is provided. An attacker could forge valid-looking tokens without a valid signature, allowing account takeover or unauthorized access to protected resources.

Technologies: jsonwebtoken (npm). Vendors: npm.

Quick answers

Is CVE-2022-23540 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23540 being exploited in the wild.
How severe is CVE-2022-23540?: Low severity, with a CVSS score of 3.1, published 22 December 2022.
Which products and versions are affected?: jsonwebtoken (npm) SEMVER:introduced=0,fixed=9.0.0.
Is there a fix for CVE-2022-23540?: Yes. jsonwebtoken (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23540 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-23540?: Check whether you run jsonwebtoken (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsonwebtoken (npm): upgrade to 9.0.0 or later
```
npm install jsonwebtoken@9.0.0
```

Technical details

The vulnerability is a signature validation bypass (CWE-287, CWE-327, CWE-347) affecting jsonwebtoken ≤8.5.1. When jwt.verify() is called with no algorithm specified and a falsy secret (null, false, undefined), the library defaults to accepting the "none" algorithm, which skips cryptographic validation entirely. An attacker can present an unsigned or self-signed token and it will be accepted as valid. The attack requires network access to an application using the vulnerable library and occurs without authentication or user interaction. The vulnerability is fixed in version 9.0.0, which removes default support for the "none" algorithm.

Affected products

Auth0 jsonwebtoken <=8.5.1

Identifiers

CVE-2022-23540
GHSA-qwph-4952-7xr6

Timeline

2022-12-22: disclosed
2022-12-22: patched: Version 9.0.0 released

References

https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.