Is CVE-2022-23541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23541 being exploited in the wild.

How severe is CVE-2022-23541?

Low severity, with a CVSS score of 3.1, published 22 December 2022.

Which products and versions are affected?

jsonwebtoken (npm) SEMVER:introduced=0,fixed=9.0.0.

Is there a fix for CVE-2022-23541?

Yes. jsonwebtoken (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23541 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-23541?

Check whether you run jsonwebtoken (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23541: jsonwebtoken insecure key retrieval leading to token forgery

CVE-2022-23541 · Severity: low · CVSS 3.1 · Published 2022-12-22

jsonwebtoken is a popular Node.js library used to create and verify digitally signed tokens that authenticate users and protect sensitive data in web applications. A flaw in the library's key validation logic allows an attacker to forge authentication tokens by switching from the intended RSA encryption algorithm to HMAC, potentially granting unauthorized access to protected resources and user accounts. Organizations using both symmetric and asymmetric keys in the same verification function are at risk.

Technologies: jsonwebtoken (npm). Vendors: npm.

Quick answers

Is CVE-2022-23541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23541 being exploited in the wild.
How severe is CVE-2022-23541?: Low severity, with a CVSS score of 3.1, published 22 December 2022.
Which products and versions are affected?: jsonwebtoken (npm) SEMVER:introduced=0,fixed=9.0.0.
Is there a fix for CVE-2022-23541?: Yes. jsonwebtoken (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23541 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-23541?: Check whether you run jsonwebtoken (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsonwebtoken (npm): upgrade to 9.0.0 or later
```
npm install jsonwebtoken@9.0.0
```

Technical details

The vulnerability is an insecure implementation of the key retrieval function in jsonwebtoken versions ≤8.5.1, allowing algorithm confusion attacks. When an application supports both symmetric (HMAC) and asymmetric (RSA) key verification within the same key retrieval function, an attacker can forge tokens by switching the signing algorithm from RSA to HMAC, as the library may incorrectly verify the token using the wrong key-algorithm combination. The attack requires the attacker to know or be able to derive the key used for verification, and the application must be misconfigured to use both key types with a poorly implemented retrieval function. This leads to successful validation of forged tokens, enabling account takeover or unauthorized access. The fix is available in version 9.0.0.

Affected products

Auth0 jsonwebtoken <=8.5.1

Identifiers

CVE-2022-23541
GHSA-hjrf-2m68-5959

Timeline

2022-12-21: disclosed
2022-12-21: patched: version 9.0.0 released

References

https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.