Vulnerability Alert: High-Severity JsonWebToken Library Vulnerability

A vulnerability was found in the open source JsonWebToken (JWT) library. According to Palo Alto Networks Unit 42, CVE-2022-23529 it could allow an attacker to achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token request.

The vulnerability impacts JsonWebToken package version 8.5.1 and earlier. CVE-2022-23529 is rated high severity with a CVSS score of 7.6. JsonWebToken is an open-source JavaScript package and is developed and maintained by Okta’s Auth0. It allows users to verify, decode, and generate JSON web tokens to securely transmit information between two parties for authorization and authentication purposes.

If an attacker is successful and runs malicious code on a server, they could overwrite arbitrary files on the host and use a poisoned secret key to perform many actions. To exploit the vulnerability and control the key, a threat actor will need to exploit a flaw within the secret management process. If successful, an attacker could gain access to confidential information and steal data.

JsonWebToken has over 10 million weekly downloads and is used by more than 22,000 projects. It is used by many open-source projects created by Microsoft, Salesforce, Intuit, IBM, Slack, Twilio, and others. Due to the library’s popularity and the potential for exploitation, Towerwall recommends that users and organizations upgrade to JsonWebToken version 9.0.0 immediately.