Miggo Logo

CVE-2015-9235: Verification Bypass in jsonwebtoken

7.5

CVSS Score

Basic Information

EPSS Score
0.9723%
Published
10/9/2018
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
jsonwebtokennpm< 4.2.24.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the verify function's lack of algorithm validation prior to the patch. The commit diff shows the addition of critical checks: 1) auto-populating options.algorithms based on key type (asymmetric vs symmetric), and 2) validating the header's alg against this whitelist. Before this fix, the function blindly trusted the attacker-controlled alg header field, allowing algorithm confusion attacks. The NVD description explicitly references this weakness in algorithm validation (CWE-20), and the commit directly modifies the verify function to address it.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

V*rsions *.*.* *n* **rli*r o* `jsonw**tok*n` *r* *****t** *y * v*ri*i**tion *yp*ss vuln*r**ility. T*is is * r*sult o* w**k v*li**tion o* t** JWT *l*orit*m typ*, o**urin* w**n *n *tt**k*r is *llow** to *r*itr*rily sp**i*y t** JWT *l*orit*m. ## R**

Reasoning

T** vuln*r**ility st*ms *rom t** v*ri*y *un*tion's l**k o* *l*orit*m v*li**tion prior to t** p*t**. T** *ommit *i** s*ows t** ***ition o* *riti**l ****ks: *) *uto-popul*tin* `options.*l*orit*ms` **s** on k*y typ* (*symm*tri* vs symm*tri*), *n* *) v*l