Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from the PyJWT._merge_options function, which is a helper function called by jwt.decode() and jwt.decode_complete(). In the vulnerable version, this function directly mutated the options dictionary provided by the caller. Specifically, when verify_signature was set to False in the options dictionary, the function would add or modify keys like verify_exp, verify_nbf, verify_iat, etc., setting their values to False directly within the original dictionary object. This in-place mutation became problematic when an application reused the same options dictionary across multiple decode calls. If an initial call disabled signature verification (and thus, implicitly, other claim verifications due to the mutation), and a subsequent call attempted to perform full verification by setting verify_signature=True on the same options dictionary, the previously mutated verify_ flags (e.g., verify_exp=False) would silently persist. This would lead to the token being accepted even if it was expired, had the wrong audience, or other invalid claims, effectively bypassing critical security checks. The patch addresses this by creating a shallow copy of the options dictionary at the beginning of _merge_options, ensuring that any modifications are made to this copy and not to the original dictionary supplied by the caller.
PyJWT._merge_optionsjwt/api_jwt.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PyJWT | pip | >= 2.11.0, <= 2.13.0 |