Executive brief
jwt-simple is a popular Node.js library for encoding and decoding JSON Web Tokens (JWTs), which are used to authenticate users and authorize access in web applications. A vulnerability in versions before 0.5.3 allows attackers to forge valid authentication tokens by exploiting a flaw in algorithm selection—if no algorithm is explicitly specified during token verification, the library trusts the algorithm embedded in the token itself, enabling an attacker to use a symmetric encryption algorithm where an asymmetric one was intended. This bypasses signature verification and allows unauthorized access to protected resources or impersonation of legitimate users.
Technical details
This is a signature verification bypass vulnerability (CWE-347) in the JWT token validation logic. The root cause is that the jwt-simple library's decode() function uses the algorithm specified in the JWT header itself when no algorithm is explicitly provided to the function. An attacker can exploit this by creating a HS256 (HMAC with SHA-256, a symmetric algorithm) token using the server's public RSA key as the HMAC secret, and the library will verify it as HS256 rather than the intended RS256 (RSA with SHA-256, an asymmetric algorithm). The attack requires no authentication or special privileges—any network-accessible application using the vulnerable library without explicitly specifying an algorithm during decoding is at risk. The vulnerability is fixed in version 0.5.3 and later, which defaults to RS256 when the algorithm is undefined but the key is an RSA key.
Affected products
- npm jwt-simple before 0.5.3
Timeline
- 2019-06-06: disclosed
- 2019-06-06: patched