How to Fix CVE-2022-23529- High Severity (RCE) Remote Code Execution Vulnerability in JsonWebToken Library?

Artur Oleyarsh, a security researcher from Palo Alto Networks Unit 42 team, reported a high-severity remote code execution vulnerability in the JsonWebToken library. The vulnerability has been tracked under the identifier CVE-2022-23529 and is considered high severity since it has got a CVSS score of 7.6 out of 10 on the CVSS scale. The high-severity flaw allows adversaries to overwrite arbitrary files on the victim machine and carry out any action using a poisoned secret key. Simply exploiting the vulnerability would lead to remote code execution on a victim server. Considering its severity and exploitability abilities, we urge users of the JsonWebToken Library to fix the vulnerability as soon as possible. We published this post that let you know how to fix CVE-2022-23529, a remote code execution vulnerability in JsonWebToken Library.

Before we jump into the details of the vulnerability, it is required to know about the JsonWebToken Library, the structure of JWT tokens, and the authentication process. Let’s start exploring one after another.

A Short Note About the JsonWebToken Library

JsonWebToken is a widely used open-source JavaScript library for handling JSON Web Tokens (JWTs). The library provides a convenient way to securely store and send user authentication credentials across multiple services. It is based on the JSON Web Token (JWT) standard that enables secure authentication and authorization between two systems, such as an online application and a service provider. This library makes it easy to generate, sign, and encrypt tokens for authentication and allows for the integrated management of user claims.

The library is developed and maintained by Auth0 and written in JavaScript, and supports a variety of platforms, including Node.js and browser-based applications. It also provides a set of helpful APIs that allow developers to quickly and easily generate JWT tokens as needed. This makes it an ideal tool to verify and sign JWTs for quickly creating secure user authentication systems, as well as for integrating with other 3rd-party services.

JWT is a JSON object which consists of three parts, each separated by a dot(.). These three parts are:

How Does a Typical JWT Look Like?

JWT format: HEADER.PAYLOAD.SIGNATURE

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

If you decode the above token, you will see the actual header, payload, and signature information.

Header: In this case is “HS256” is algorithm and “JWT” is type.

{  
"alg": "HS256",  
"typ": "JWT"
}

Payload: n this case, the user information.

{  
"sub": "1234567890",  
"name": "John Doe",  
"iat": 1516239022
}

Signature: It’s calculated by applying taking encoded header, payload and a secret key into this formula.

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The formula used to calculate the Signature of JWT.

HMACSHA256( 
  base64UrlEncode(header) + "." + 
  base64UrlEncode(payload), 
  secret_key 
)

Note: JWT is self-contained, meaning it carries all the information necessary to verify the token, so no additional calls to the database are needed.

The Role of JWT in Authentication Process

To know about the vulnerability, it is important to understand the role of JWT tokens in Authentication process. Let’s see the authentication process in bullet points.

Diagram of the process of authentication with JWT. (Source: Palo Alto)

IMP Note: if the secret keys are not stored securely, an attacker who can control the secret key will be able to execute code on a host verifying JWT and use that access to extract or change the sensitive data.

Summary of CVE-2022-23529

According to Artur Oleyarsh, who disclosed this flaw, “in order to exploit the vulnerability described in this post and control the secretOrPublicKey value, an attacker will need to exploit a flaw within the secret management process. Thus, due to the complexity of this vulnerability, we suggested a CVSS score of 7.6”
– Artur Oleyarsh

This is a high-severity vulnerability in the JsonWebToken library. Attackers would abuse this vulnerability which further leads to overwriting arbitrary files on the victim’s machine and carrying out any action using a poisoned secret key. The actual vulnerability lies in the insecure input validation in jwt.verify function in JWT. This allows an attacker to exploit this flaw just by crafting a malicious JSON web token (JWT) request with the poisoned secret key.

The vulnerability tracked under the identifier CVE-2022-23529 is considered high severity since it has got a base score of 7.6 out of 10 on the CVSS scale. Please see the CWE vector details in the below table.

How to Fix CVE-2022-23529- High Severity (RCE) Remote Code Execution Vulnerability in JsonWebToken

According to the technical details, the flaw affects all the versions below v9.0.0. In v9.0.0, proper input validation is implemented in the jwt.verify function. The moderators urge to migrate the JsonWebToken Library to 9.x version to fix the CVE-2022-23529 vulnerability.

Please refer to these migration notes to migrate the JsonWebToken library.

For more information, please refer: https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback

We hope this post would help you know how to fix CVE-2022-23529, a remote code execution vulnerability in JsonWebToken Library. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this. 

You may also like these articles: