Executive brief
njwt is a library used by developers to handle JSON Web Tokens (JWTs) for user authentication and data exchange. A vulnerability in this library allows an attacker to send a specially crafted token that can crash the application or bypass certain security checks. This could lead to service outages or unauthorized access if the application relies on specific token attributes for its security logic.
Technical details
A prototype pollution vulnerability exists in njwt versions up to 0.4.0 within the Parser.prototype.parse method. The vulnerability occurs because the library fails to validate that attributes assigned to JwtHeader and JwtBody objects do not resolve to the object prototype. An attacker can exploit this by providing a JWT containing a __proto__ property in the header or body. When nJwt.verify() is called, the parser merges these properties, allowing the attacker to overwrite inherited properties like 'compact', 'toJSON', or 'reservedKeys'. This can lead to a Denial of Service (DoS) via application crashes or the bypassing of security logic that depends on the integrity of these objects. The issue is fixed in version 2.0.1 by freezing the prototypes of affected classes.
Affected products
- jwtk njwt <= 0.4.0
Timeline
- 2024-04-27: disclosed: Issue reported on GitHub by chrisandoryan
- 2024-05-16: advisory: CVE-2024-34273 published
- 2024-06-11: patched: Fix committed to repository