PT-2018-9428 · Inversoft · Prime-Jwt

Rcadob · Publicado 2018-06-26 · Atualizado 2018-08-30 · CVE-2018-1000531

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions inversoft prime-jwt versions prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba

Description The issue concerns an incorrect signature validation of a JWT token. An attacker can exploit this by crafting a JWT token with a valid header using 'none' as the algorithm and a body, then requesting it to be validated. This occurs due to a flaw in the JWTDecoder.decode function.

Recommendations For inversoft prime-jwt versions prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba, update to a version that includes the fix after commit abb0d479389a2509f939452a6767dc424bb5e6ba to resolve the issue. As a temporary workaround, consider validating JWT tokens with additional checks to ensure the algorithm is not set to 'none' before passing them to the JWTDecoder.decode function.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1000531

Produtos afetados

Prime-Jwt

Referências · 3

• https://github.com/inversoft/prime-jwt/issues/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000531 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000531 · Aviso do Fabricante