CVE-2015-9235
published 2018-05-29CVE-2015-9235: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES…
PriorityP357critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
8.65%
94.5th percentile
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| auth0 | jsonwebtoken | < 4.2.2 | 4.2.2 |
| auth0 | jsonwebtoken | >= 0 < 4.2.2 | 4.2.2 |
| hackerone | jsonwebtoken_node_module | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →An attacker exploiting this vulnerability sends a JWT token signed with a symmetric algorithm (HS* family) to a server that expects an asymmetric algorithm (RS/ES family), bypassing signature verification in jsonwebtoken node module before 4.2.2. ↗
- →Inspect incoming JWT headers for algorithm confusion: flag tokens where the server is configured for RS*/ES* algorithms but the token's 'alg' header field specifies an HS* (HMAC) algorithm. ↗
- →Review the fix commit at https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687 to understand the verification logic change; audit verify.js for enforcement of expected algorithm at line ~62. ↗
- ·Only jsonwebtoken node module versions before 4.2.2 are vulnerable; version 7.2.1 and later are not affected due to algorithm enforcement in verify.js. ↗
- ·The vulnerability is only exploitable when the server is configured to accept tokens signed with asymmetric (RS/ES) algorithms but does not explicitly reject tokens presenting symmetric (HS*) algorithms in the header. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Verification Bypass in jsonwebtoken
ghsa·2018-10-09
CVE-2015-9235 [CRITICAL] CWE-20 Verification Bypass in jsonwebtoken
Verification Bypass in jsonwebtoken
Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.
## Recommendation
Update to version 4.2.2 or later.
OSV
Verification Bypass in jsonwebtoken
osv·2018-10-09
CVE-2015-9235 [CRITICAL] Verification Bypass in jsonwebtoken
Verification Bypass in jsonwebtoken
Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.
## Recommendation
Update to version 4.2.2 or later.
Red Hat
nodejs-jsonwebtoken: verification step bypass with an altered token
vendor_redhat·2018-03-31·CVSS 9.8
CVE-2015-9235 [CRITICAL] CWE-287 nodejs-jsonwebtoken: verification step bypass with an altered token
nodejs-jsonwebtoken: verification step bypass with an altered token
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Package: nodejs-jsonwebtoken (Red Hat Mobile Application Platform 4) - Not affected
No detection rules found.
No public exploits indexed.
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687https://nodesecurity.io/advisories/17https://www.timmclean.net/2015/02/25/jwt-alg-none.htmlhttps://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687https://nodesecurity.io/advisories/17https://www.timmclean.net/2015/02/25/jwt-alg-none.html
2018-05-29
Published