PT-2024-25776 · Njwt · Njwt

Published 2024-05-16 · Updated 2024-08-01 · CVE-2024-34273

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions njwt versions up to 0.4.0

Description The issue is related to a prototype pollution in the Parser.prototype.parse method. This method is part of the njwt library, which suggests the pollution occurs during the parsing process, potentially allowing an attacker to modify the prototype of an object.

Recommendations For njwt versions up to 0.4.0, update to a version higher than 0.4.0 to resolve the issue. As a temporary workaround, consider restricting the use of the Parser.prototype.parse method until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-34273

GHSA-3HVJ-2783-34X2

Affected Products

Njwt

References · 9

• 🔥 https://github.com/chrisandoryan/vuln-advisory/blob/main/nJwt/CVE-2024-34273.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34273 · Security Note
• https://osv.dev/vulnerability/GHSA-3hvj-2783-34x2 · Vendor Advisory
• https://github.com/jwtk/njwt · Note
• https://github.com/jwtk/njwt/issues/105 · Note
• https://github.com/jwtk/njwt/commit/ec9483b6eec1150d56f772ddd308c2bbdf2f98f4 · Note
• https://twitter.com/CVEnew/status/1791128237214748691 · Twitter Post
• https://t.me/cvenotify/80319 · Telegram Post
• https://t.me/cvenotify/80057 · Telegram Post