Junglewise Threat Intelligence

CVE-2022-25898: kjur jsrsasign improper signature verification in JWS and JWT

CVE-2022-25898 · Severity: low · CVSS 3.1 · Published 2022-06-25

Technologies: jsrsasign (npm). Vendors: npm.

Executive brief

The jsrsasign library, a popular JavaScript tool for cryptography and digital signatures, contains a flaw in how it validates security tokens. An attacker can modify a security token (JWT) by inserting special characters, and the library will incorrectly treat the tampered token as valid. This could allow unauthorized users to bypass authentication or gain elevated permissions in applications using this library for OpenID Connect or OAuth2.

Technical details

The jsrsasign library before version 10.5.25 is vulnerable to improper verification of cryptographic signatures (CWE-347). The vulnerability exists in the JWS.verify and JWS.verifyJWT methods, which fail to strictly validate the character set of the signature string. Specifically, signatures containing non-Base64URL characters (such as '!', '@', or escaped numeric characters) may be incorrectly validated as authentic. This allows an attacker to append or inject certain characters into a valid signature without invalidating it. In environments using this library for OAuth2 or OpenID Connect, this can lead to authentication or authorization bypass. The issue is fixed in version 10.5.25 by ensuring the signature string is Base64URL and dot-safe before verification.

Affected products

  • kjur jsrsasign >= 4.8.0, < 10.5.25

Timeline

  • 2022-06-13: disclosed: Vulnerability reported by Adi Malyanker and Or David
  • 2022-06-23: patched: Version 10.5.25 released with security fix
  • 2022-06-25: advisory: GitHub Security Advisory published

References

Related threats