CVE-2022-23539: jsonwebtoken unrestricted key type could lead to legacy keys usage
Overview
Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.
Am I affected?
You are affected if you are using an algorithm and a key type other than the combinations mentioned below
| Key type | algorithm | |----------|------------------------------------------| | ec | ES256, ES384, ES512 | | rsa | RS256, RS384, RS512, PS256, PS384, PS512 | | rsa-pss | PS256, PS384, PS512 |
And for Elliptic Curve algorithms:
| alg | Curve | |-------|------------| | ES256 | prime256v1 | | ES384 | secp384r1 | | ES512 | secp521r1 |
How do I fix it?
Update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.
Will the fix impact my users?
There will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise, use the allowInvalidAsymmetricKeyTypes option to true in the sign() and verify() functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility.
Other sources
A flaw was found in the jsonwebtoken package. The affected versions of the jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.
Auth0 jsonwebtoken could provide weaker than expected security, caused by an unrestricted key type issue. A remote authenticated attacker could exploit this vulnerability to allow legacy keys usage and launch further attacks on the system.
— IBM
Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23539?
CVE-2022-23539 has been classified as a medium severity vulnerability due to the potential for insecure signature verification.
How do I fix CVE-2022-23539?
To fix CVE-2022-23539, upgrade the jsonwebtoken library to version 9.0.0 or later.
Which versions of jsonwebtoken are affected by CVE-2022-23539?
Versions of jsonwebtoken up to and including 8.5.1 are affected by CVE-2022-23539.
Can CVE-2022-23539 affect my application if I use an insecure key type?
Yes, if your application uses an insecure key type for signature verification, it is vulnerable to CVE-2022-23539.
What algorithms are improperly handled in CVE-2022-23539?
CVE-2022-23539 improperly handles legacy algorithms such as DSA keys with the RS256 signing algorithm.