Description
Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.8.0, < 10.5.25
- Patched version(s): 10.5.25
References
Could your website be exposed too?
SmartScanner can check your website for JWS and JWT signature validation vulnerability with special characters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RSA signature validation vulnerability on maleable encoded message in jsrsasign - CVE-2021-30246
- ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
- RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968
- secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery - CVE-2022-41340
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023