CVE-2016-10555

Published: May 31, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.

Affected (1)

Products: Jwt Simple Project: Jwt Simple

Jwt Simple Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jwt Simple Project Jwt Simple	Up to 0.3.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

Source: support@hackerone.com

Broken LinkThird Party Advisory

https://github.com/hokaccha/node-jwt-simple/pull/14

Source: support@hackerone.com

Issue TrackingThird Party Advisory

https://github.com/hokaccha/node-jwt-simple/pull/16

Source: support@hackerone.com

Issue TrackingThird Party Advisory

https://nodesecurity.io/advisories/87

Source: support@hackerone.com

Third Party Advisory

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party Advisory

https://github.com/hokaccha/node-jwt-simple/pull/14

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/hokaccha/node-jwt-simple/pull/16

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://nodesecurity.io/advisories/87

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.