Executive brief
fast-jwt is a JavaScript library used to create and verify JSON Web Tokens (JWTs), which are commonly used for API authentication. The library incorrectly validates public key formats, allowing an attacker to forge valid JWT tokens by switching the signing algorithm from RS256 to HS256 and signing with the public key itself. This can enable account takeover or privilege escalation if applications don't explicitly restrict the allowed algorithms.
Technical details
The vulnerability is an algorithm confusion attack stemming from improper input validation (CWE-20) in the publicKeyPemMatcher regular expression in fast-jwt/src/crypto.js. The matcher fails to recognize all valid PEM public key formats, specifically those with the "BEGIN RSA PUBLIC KEY" header. An attacker who obtains the application's public key (via token inspection or public endpoints) can craft a malicious JWT with the HS256 algorithm, sign it with the public key, and submit it to applications that call the verify function without explicitly specifying the allowed algorithm. No authentication or user interaction is required; only network access to the JWT endpoint is needed. The attack only succeeds on applications using RS256 with RSA public key format and not explicitly restricting algorithms. Patched in version 3.3.2.
Affected products
- NearForm fast-jwt < 3.3.2
Timeline
- 2023-11-20: disclosed
- 2023-11-20: patched: Version 3.3.2 released