What You Need to Know:
A vulnerability was found in the open source JsonWebToken (JWT) library. According to Palo Alto Networks Unit 42, CVE-2022-23529 it could allow an attacker to achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token request.
If an attacker is successful and runs malicious code on a server, they could overwrite arbitrary files on the host and use a poisoned secret key to perform many actions. To exploit the vulnerability and control the key, a threat actor will need to exploit a flaw within the secret management process. If successful, an attacker could gain access to confidential information and steal data.
JsonWebToken has over 10 million weekly downloads and is used by more than 22,000 projects. It is used by many open-source projects created by Microsoft, Salesforce, Intuit, IBM, Slack, Twilio, and others. Due to the library’s popularity and the potential for exploitation, Towerwall recommends that users and organizations upgrade to JsonWebToken version 9.0.0 immediately.
Towerwall recommends that organizations and users using JsonWebToken versions 8.5.1 and earlier apply the appropriate patch. You can find patch guidance here.
Indicators of Compromise (IoCs):
At this time, there are no known IoCs associated with CVE-2022-23529. Our partners Avertium’s hunters remain vigilant in locating IoCs for our customers. Should any be located, Towerwall will disclose them as soon as possible. For more information on how Towerwall can help protect your organization, please reach out to your Towerwall Service Delivery Manager or Account Executive.
- Disclosing a New Vulnerability in JWT Secret Poisoning (CVE-2022-23529) (paloaltonetworks.com)
- Severe Security Flaw Found in “jsonwebtoken” Library Used by 22,000+ Projects (thehackernews.com)
- Release v9.0.0: Merge pull request from GHSA-8cf7-32gw-wr33 · auth0/node-jsonwebtoken · GitHub
- GitHub – auth0/node-jsonwebtoken: JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html
- Auth0 fixes RCE flaw in JsonWebToken library used by 22,000 projects (bleepingcomputer.com)
If you have any questions about this vulnerability or your information security needs, please contact us directly at 774-204-0700.