JsonWebToken Security Bug Opens Servers to RCE

The JsonWebToken package plays a big role in the authentication and authorization functionality for many applications.

A high-severity vulnerability (
CVE-2022-23529
) has been discovered in the popular JsonWebToken (JWT) open source encryption project, which could be used by attackers to achieve remote code execution (RCE) on a target encryption server.
The JWT open standard defines a method of transferring information securely by encoding and signing JSON data. According to researchers at Palo Alto Networks Unit 42, an exploit for the vulnerability results in the server verifying a maliciously crafted JSON web token request.
Running malicious code on a server can lead to a huge damage and loss of confidentiality, integrity, and also may cause a denial of service, cautions Unit 42 security researcher Artur Oleyarsh. Systems related to and communicating with the vulnerable server may suffer as well, so the attack potential and the consequences once the system is vulnerable for a remote code execution is significant.
The issue poses a threat to all who are using JWT versions prior and including v8.5.1. The patched version of the package is v9.0.0, according to a
Jan. 9 posting
from Unit 42.
Oleyarsh explains that usually, vulnerabilities related to JSON Web tokens are related to different token forging techniques that allow a malicious actor to bypass authentication and authorization mechanisms.
This gives them [the] opportunity to take over accounts, impersonate users, and elevate privileges, he says. However, this latest vulnerability is unique for several reasons. First, here we are talking about executing code on a host verifying JSON web tokens.
Rather than bypassing authentication or authorization mechanisms, the bug provides a way for a cyberattacker to gain control over a key retrieval parameter of the jwt.verify function (known as
secretOrPublicKey
).
In a proof-of-concept exploit, Unit 42 was able to override the toString() method of the key object.
In JavaScript, every object that inherits from Object.prototype, inherit the toString() method, Oleyarsh says. Thus, if there is a blindly trusted call to that method, and we control the key object, we can override its toString() with malicious content and execute arbitrary code.
As the use of open source software (OSS) continues to grow, so does cyberattacker interest in using software components and packages like JWT as an attack vector.
We are seeing threat actors actively scanning for known vulnerabilities and exploiting them within minutes, Oleyarsh says. Without attention and awareness to OSS security, I think we will see more and more attacks leveraging OSS security issues.
He says as a community, security practitioners need to contribute and cooperate to make OSS software safer.
Some of the developers and maintainers of OSS are building solutions with security in mind, which means that they are constantly fixing security vulnerabilities, scanning for vulnerable dependencies, and maintaining security advisories and publishing them so the users can patch for the non-vulnerable versions, and some of them are not, Oleyarsh notes.
Increasingly, tools
have been launched
to help defense, identity and access management, and security operations center teams discover vulnerable components. Googles
OSV-Scanner
, which launched in December, for instance generates a list of dependencies in a software development project and checks the OSV database for known vulnerabilities.
Some are doing a great job in creating wonderful and creative solutions for many problems and making it available for use to anyone without charge, Oleyarsh says. If you are implementing OSS within your organization, it is a good practice to use OSS package scanners to scan for vulnerable versions of OSS packages you are using, as well for vulnerable dependencies.
Meanwhile Google is also throwing its considerable weight behind a proposed US government-led
policy framework
aimed at shoring up security for open source software, urging the private sector to support the initiative.
From a manual perspective, Oleyarsh adds that teams should take a regular look at the security advisories pages of the OSS projects they use to keep up to date on bugs, and look at implementing software composition analysis (SCA) tools to help to track all the open source packages and modules used by a project in order to inform that process.
Then, when you encounter a bug which has security implications, it is a good practice to reach out to the maintainers via a private chat and report the issue and even suggest and discuss the solution, he says.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
JsonWebToken Security Bug Opens Servers to RCE