Vulnerable Package issue exists @ Npm-jsonwebtoken-5.0.0 in branch main
jsonwebtoken is an implementation of JSON Web Tokens. Versions prior to 9.0.0 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in "jwt.verify()" implementation with the same key retrieval function.
Vulnerable Package issue exists @ Npm-jsonwebtoken-5.0.0 in branch main
jsonwebtoken is an implementation of JSON Web Tokens. Versions prior to 9.0.0 of
jsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in "jwt.verify()" implementation with the same key retrieval function.Namespace: westonphillips Repository: CheckmarxOnePOV Repository Url: https://github.com/westonphillips/CheckmarxOnePOV CxAST-Project: westonphillips/CheckmarxOnePOV CxAST platform scan: 6a8170d0-38fa-4efc-81df-42628474102c Branch: main Application: CheckmarxOnePOV Severity: MEDIUM State: NOT_IGNORED Status: RECURRENT CWE: CWE-1259
Additional Info Attack vector: NETWORK Attack complexity: LOW Confidentiality impact: LOW Availability impact: LOW Remediation Upgrade Recommendation: 9.0.0
References Advisory Commit Release Note