Flash Notice: High-Severity JsonWebToken Library Vulnerability

overview

A vulnerability was found in the open source JsonWebToken (JWT) library. According to Palo Alto Networks Unit 42, CVE-2022-23529 it could allow an attacker to achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token request.  

The vulnerability impacts JsonWebToken package version 8.5.1 and earlier. CVE-2022-23529 is rated high severity with a CVSS score of 7.6. JsonWebToken is an open-source JavaScript package and is developed and maintained by Okta’s Auth0. It allows users to verify, decode, and generate JSON web tokens to securely transmit information between two parties for authorization and authentication purposes.  

If an attacker is successful and runs malicious code on a server, they could overwrite arbitrary files on the host and use a poisoned secret key to perform many actions. To exploit the vulnerability and control the key, a threat actor will need to exploit a flaw within the secret management process. If successful, an attacker could gain access to confidential information and steal data. 

JsonWebToken has over 10 million weekly downloads and is used by more than 22,000 projects. It is used by many open-source projects created by Microsoft, Salesforce, Intuit, IBM, Slack, Twilio, and others. Due to the library’s popularity and the potential for exploitation, Avertium recommends that users and organizations upgrade to JsonWebToken version 9.0.0 immediately.  

Avertium's recommendations    

Avertium recommends that organizations and users using JsonWebToken versions 8.5.1 and earlier apply the appropriate patch. You can find patch guidance here.  

indicators of compromise (ioCs)  

At this time, there are no known IoCs associated with CVE-2022-23529. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive. 

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so, you’ll have no more blind spots, weak links, or fire drills. 
• Avertium recommends utilizing our service for DFIR (Digital Forensics and Incident Response) to help you rapidly assess, contain, eradicate, and recover from a security incident like a malware attack. 
• Fusion MXDR is the first MDR offering that fuses together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts.