PT-2023-19302 · Unknown · Reason-Jose

Nankeen · Publicado 2023-02-01 · Atualizado 2023-02-08 · CVE-2023-23928

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions reason-jose versions prior to 0.8.2

Description The issue affects the Jose.Jws.validate function, which does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks, potentially exposing applications to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation.

Recommendations For versions prior to 0.8.2, update to version 0.8.2 to resolve the issue. As a temporary workaround, consider implementing additional checks for HS256 signatures to prevent tampering of JWS header and payload data. Restrict access to sensitive applications relying on JWS claims assertion to minimize the risk of exploitation.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2023-23928

GHSA-7JJ9-6QWV-WPM7

Produtos afetados

Reason-Jose

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23928.json · Exploit
• https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5 · Correção
• https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7 · Nota
• https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2 · Nota
• https://osv.dev/vulnerability/CVE-2023-23928 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23928 · Nota de Segurança
• https://t.me/cibsecurity/57237 · Publicação no Telegram