Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 15 May 2024.

Is there a fix for This vulnerability?

A patch was published on 2024-05-15T21:47:39Z: Fix identified in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run gree/jose (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

gree jose signature bypass via none algorithm

Severity: critical · CVSS 9.8 · Published 2024-05-15

The gree/jose library, used for handling JSON Web Tokens (JWT) in PHP applications, contains a flaw that allows attackers to bypass security checks. By using a specially crafted token that specifies no encryption (the "none" algorithm), an attacker can impersonate other users or gain unauthorized access to sensitive data. This could lead to full account takeover or unauthorized operations within the affected application.

Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 15 May 2024.
Which products and versions are affected?: gree/jose (Packagist) < 2.2.1.
Is there a fix for This vulnerability?: A patch was published on 2024-05-15T21:47:39Z: Fix identified in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run gree/jose (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The gree/jose library is vulnerable to a signature bypass due to improper verification of the 'none' algorithm in JSON Web Tokens (JWT). When a token is presented with the 'alg' header set to 'none', the library may treat the token as valid without verifying a cryptographic signature. This allows a remote, unauthenticated attacker to forge tokens with arbitrary payloads, such as elevated privileges or different user identities, by simply removing the signature and updating the header. The vulnerability is rooted in the improper implementation of CWE-347 and CWE-327. The issue is addressed in version 2.2.1.

Affected products

gree jose < 2.2.1

Timeline

2024-05-15: advisory: GitHub Advisory published
2024-05-15: patched: Fix identified in version 2.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.