PT-2024-19006 · Jwx · Jwx
Frestr
·
Published
2024-01-09
·
Updated
2024-02-05
·
CVE-2024-21664
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
jwx versions prior to 1.2.28
jwx versions prior to 2.0.19
Description
The issue arises when calling
jws.Parse with a JSON serialized payload where the signature field is present while protected is absent, leading to a nil pointer dereference. This can be used to crash or perform a denial-of-service (DOS) attack on a system doing JWS verification. The vulnerability affects other functions that call Parse internally, such as jws.Verify. These functions are supposed to fail gracefully on invalid input and do not require prior validation. The problem occurs because the processing done in jws/message.go:UnmarshalJSON() assumes that if a signature field is present, then a protected field is also present. If this is not the case, the subsequent call to getB64Value(sig.protected) will dereference sig.protected, which is nil.Recommendations
For versions prior to 1.2.28, update to version 1.2.28 or later.
For versions prior to 2.0.19, update to version 2.0.19 or later.
As a temporary workaround, consider validating the input to ensure that the
protected field is present when the signature field is present, before calling jws.Parse.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jwx