Important Update - January 27, 2023
After review and validation of community feedback regarding the viability of exploitation, it was determined that due to the multiple prerequisites required for successful exploitation, a CVE was not warranted and therefore a decision was made to retract CVE-2022-23529.
The security issue remains a concern only when the JsonWebToken library is used in an insecure way. In such a scenario, if all the prerequisites are met, the issue may be exploitable; however, the source of this risk is the calling code and not the library itself.
Overview
For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE).
Am I affected?
This security issue is a concern when the jsonwebtoken library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the jwt.verify() on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.
How do I fix it?
Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks.
Important Update - January 27, 2023
After review and validation of community feedback regarding the viability of exploitation, it was determined that due to the multiple prerequisites required for successful exploitation, a CVE was not warranted and therefore a decision was made to retract CVE-2022-23529.
The security issue remains a concern only when the
JsonWebTokenlibrary is used in an insecure way. In such a scenario, if all the prerequisites are met, the issue may be exploitable; however, the source of this risk is the calling code and not the library itself.Overview
For versions
<=8.5.1ofjsonwebtokenlibrary, if a malicious actor has the ability to modify the key retrieval parameter (referring to thesecretOrPublicKeyargument from the readme link) of thejwt.verify()function, they can gain remote code execution (RCE).Am I affected?
This security issue is a concern when the
jsonwebtokenlibrary is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of thejwt.verify()on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.How do I fix it?
Users of
jsonwebtoken8.5.1and earlier are encouraged to update to the latest version,9.0.0, which presents safer code and important security checks.