Vulnerability Alert: High-Severity JsonWebToken Library Vulnerability

leadership team img1

By Michelle Drolet

Founder & CEO

Ms. Drolet is responsible for all aspects of business for Towerwall. She has more than 24 years of,

Read More

What You Need to Know:

A vulnerability was found in the open source JsonWebToken (JWT) library. According to Palo Alto Networks Unit 42, CVE-2022-23529 it could allow an attacker to achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token request.

The vulnerability impacts JsonWebToken package version 8.5.1 and earlier. CVE-2022-23529 is rated high severity with a CVSS score of 7.6. JsonWebToken is an open-source JavaScript package and is developed and maintained by Okta’s Auth0. It allows users to verify, decode, and generate JSON web tokens to securely transmit information between two parties for authorization and authentication purposes.

If an attacker is successful and runs malicious code on a server, they could overwrite arbitrary files on the host and use a poisoned secret key to perform many actions. To exploit the vulnerability and control the key, a threat actor will need to exploit a flaw within the secret management process. If successful, an attacker could gain access to confidential information and steal data.

JsonWebToken has over 10 million weekly downloads and is used by more than 22,000 projects. It is used by many open-source projects created by Microsoft, Salesforce, Intuit, IBM, Slack, Twilio, and others. Due to the library’s popularity and the potential for exploitation, Towerwall recommends that users and organizations upgrade to JsonWebToken version 9.0.0 immediately.

High Severity JsonWebToken Library Vulnerability
High Severity JsonWebToken Library Vulnerability

 Towerwall Recommendations:

Towerwall recommends that organizations and users using JsonWebToken versions 8.5.1 and earlier apply the appropriate patch. You can find patch guidance here.

Indicators of Compromise (IoCs):

At this time, there are no known IoCs associated with CVE-2022-23529. Our partners Avertium’s hunters remain vigilant in locating IoCs for our customers. Should any be located, Towerwall will disclose them as soon as possible. For more information on how Towerwall can help protect your organization, please reach out to your Towerwall Service Delivery Manager or Account Executive.

Supporting Documentation:



If you have any questions about this vulnerability or your information security needs, please contact us directly at 774-204-0700.