PT-2022-17594 · Jsrsasign · Jsrsasign
Adi Malyanker
+1
·
Published
2022-06-25
·
Updated
2022-07-13
·
CVE-2022-25898
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
jsrsasign versions prior to 10.5.25
Description
The issue concerns improper verification of cryptographic signatures. Specifically, JWS or JWT signatures with non-Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. This can affect authentication or authorization when jsrsasign's JWS or JWT validation is used in OpenID Connect or OAuth2.
Recommendations
For versions prior to 10.5.25, validate JWS or JWT signatures if they have Base64URL and dot safe string before executing
JWS.verify() or JWS.verifyJWT() method. Users should upgrade to version 10.5.25 to resolve the issue. As a temporary workaround, consider validating the signature string manually to ensure it only contains Base64URL and dot safe characters before executing the verification methods.Exploit
Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jsrsasign