Is CVE-2022-25898 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25898 being exploited in the wild.

How severe is CVE-2022-25898?

Low severity, with a CVSS score of 3.1, published 25 June 2022.

Which products and versions are affected?

jsrsasign (npm) SEMVER:introduced=4.8.0,fixed=10.5.25.

Is there a fix for CVE-2022-25898?

Yes. jsrsasign (npm): upgrade to 10.5.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25898 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25898?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25898: kjur jsrsasign improper signature verification in JWS and JWT

CVE-2022-25898 · Severity: low · CVSS 3.1 · Published 2022-06-25

The jsrsasign library, a popular JavaScript tool for cryptography and digital signatures, contains a flaw in how it validates security tokens. An attacker can modify a security token (JWT) by inserting special characters, and the library will incorrectly treat the tampered token as valid. This could allow unauthorized users to bypass authentication or gain elevated permissions in applications using this library for OpenID Connect or OAuth2.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2022-25898 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25898 being exploited in the wild.
How severe is CVE-2022-25898?: Low severity, with a CVSS score of 3.1, published 25 June 2022.
Which products and versions are affected?: jsrsasign (npm) SEMVER:introduced=4.8.0,fixed=10.5.25.
Is there a fix for CVE-2022-25898?: Yes. jsrsasign (npm): upgrade to 10.5.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25898 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25898?: Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsrsasign (npm): upgrade to 10.5.25 or later
```
npm install jsrsasign@10.5.25
```

Technical details

The jsrsasign library before version 10.5.25 is vulnerable to improper verification of cryptographic signatures (CWE-347). The vulnerability exists in the JWS.verify and JWS.verifyJWT methods, which fail to strictly validate the character set of the signature string. Specifically, signatures containing non-Base64URL characters (such as '!', '@', or escaped numeric characters) may be incorrectly validated as authentic. This allows an attacker to append or inject certain characters into a valid signature without invalidating it. In environments using this library for OAuth2 or OpenID Connect, this can lead to authentication or authorization bypass. The issue is fixed in version 10.5.25 by ensuring the signature string is Base64URL and dot-safe before verification.

Affected products

kjur jsrsasign >= 4.8.0, < 10.5.25

Identifiers

CVE-2022-25898
GHSA-3fvg-4v2m-98jf

Timeline

2022-06-13: disclosed: Vulnerability reported by Adi Malyanker and Or David
2022-06-23: patched: Version 10.5.25 released with security fix
2022-06-25: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.