PT-2020-12224 · Jpadilla · Drf-Jwt

Published 2020-03-15 · Updated 2020-06-05 · CVE-2020-10594

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions drf-jwt versions 1.15.x before 1.15.1

Description An issue in drf-jwt allows attackers with access to a notionally invalidated token to obtain a new, working token via the "refresh endpoint", because the blacklist protection mechanism is incompatible with the token-refresh feature. drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.

Recommendations For versions 1.15.x before 1.15.1, update to version 1.15.1 or later to resolve the issue. As a temporary workaround, consider disabling the token-refresh feature until a patch is available. Restrict access to the refresh endpoint to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-10594

GHSA-FPJM-RP2G-3R4C

PYSEC-2020-40

Affected Products

Drf-Jwt

References · 12

• https://osv.dev/vulnerability/PYSEC-2020-40 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpjm-rp2g-3r4c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10594 · Security Note
• https://github.com/jpadilla/django-rest-framework-jwt/issues/484 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/drf-jwt/PYSEC-2020-40.yaml · Note
• https://github.com/Styria-Digital/django-rest-framework-jwt/issues/36 · Note
• https://github.com/Styria-Digital/django-rest-framework-jwt/commit/868b5c22ddad59772b447080183e7c7101bb18e0 · Note
• https://github.com/Styria-Digital/django-rest-framework-jwt · Note
• https://github.com/advisories/GHSA-fpjm-rp2g-3r4c · Note
• https://pypi.org/project/drf-jwt/1.15.1/#history · Note
• https://t.me/cvenotify/1701 · Telegram Post