Cisco node-jose improper validation of JWT signature

Description

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs).

Recommendation

Update the node-jose package to the latest compatible version. Followings are version details:

Affected version(s): < 0.11.0
Patched version(s): 0.11.0

References

GHSA-jfxm-w8g2-4rcv
tools.cisco.com
www.exploit-db.com
web.archive.org
CVE-2018-0114
CWE-347
CAPEC-310
OWASP 2021-A2
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cisco node-jose improper validation of JWT signature and gives you actionable findings to investigate.

Start a free scan

Related Issues

JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
Improper Input Validation in SocksJS-Node - CVE-2020-7693
Improper Input Validation in Deap - CVE-2018-3749
Invalid Curve Attack in node-jose - CVE-2017-16007

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated October 14, 2023