Junglewise Threat Intelligence

node-jwt-simple algorithm confusion vulnerability

Severity: info · Published 2020-08-03

Technologies: jwt-simple (npm). Vendors: npm.

Executive brief

This advisory has been withdrawn as a duplicate. The vulnerability affected jwt-simple, a JavaScript library used to encode and decode JSON Web Tokens (JWTs). The original issue involved an algorithm confusion weakness in the token verification process that could allow attackers to bypass signature validation under certain conditions.

Technical details

The vulnerability involved improper algorithm handling in the JWT decode/verification method. The library initially did not properly enforce or validate the algorithm parameter during token verification, potentially allowing an attacker to specify or override the algorithm used for signature validation. This advisory was withdrawn as a duplicate of GHSA-vgrx-w6rg-8fqf, indicating the same issue was tracked elsewhere. The fix involved adding an explicit algorithm parameter to the decode method that overrides the token's embedded algorithm specification and performs verification with the specified algorithm.

Affected products

  • hokaccha node-jwt-simple before 0.3.1

Timeline

  • 2020-08-03: disclosed
  • other: Advisory withdrawn as duplicate of GHSA-vgrx-w6rg-8fqf

References

Related threats