Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-25574

CVE-2023-25574: LTI JupyterHub Authenticator does not properly validate JWT Signature

10

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-25574
GHSA ID
GHSA-mcgx-2gcr-p3hp
EPSS Score
0.34882%
CWE
CWE-347
Published
2/25/2025
Updated
2/25/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
jupyterhub-ltiauthenticatorpip= 1.3.01.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the jwt_verify_and_decode method in validator.py explicitly disabling JWT signature verification via jwt.decode(..., verify=False). The CWE-347 description and advisory references confirm this lack of validation allows forged requests. The code segment provided in the vulnerability details (lines 122-164) corresponds to this function's implementation. The removal of LTI13Authenticator in v1.4.0 further corroborates this was the root cause.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Only us*rs t**t **s *on*i*ur** * Jupyt*r*u* inst*ll*tion to us* t** *ut**nti**tor *l*ss `LTI***ut**nti**tor` *r* in*lu*n***. LTI***ut**nti**tor t**t w*s intro*u*** in `jupyt*r*u*-lti*ut**nti**tor` *.*.* w*sn't v*li**tin* JWT si*n*tur*s.

Reasoning

T** vuln*r**ility st*ms *rom t** `jwt_v*ri*y_*n*_***o**` m*t*o* in v*li**tor.py *xpli*itly *is**lin* JWT si*n*tur* v*ri*i**tion vi* `jwt.***o**(..., v*ri*y=**ls*)`. T** *W*-*** **s*ription *n* **visory r***r*n**s *on*irm t*is l**k o* v*li**tion *llow