GHSA-gjcw-v447-2w7q CVE-2016-1000223
Forgeable Public/Private Tokens in jws
- Severity
- 8.7 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
3.0.0- Upgrade jws to this version or later
Description
Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.
Recommendation
Update to version 3.0.0 or later.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| jws | < 3.0.0 |
3.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
jws npm → 3.0.0
- npm
npm install jws@3.0.0- yarn
yarn add jws@3.0.0- pnpm
pnpm add jws@3.0.0
Severity breakdown
CVSS 3.1 8.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-869p-cjfg-cm3x auth0/node-jws Improperly Verifies HMAC Signature | High | Also affects jws |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor