Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 31 Mar 2015 22:53:52 -0700
From: "Jeremy Spilman" <>
To: "" <>
Subject: Signature Bypass in several JSON Web Token Libraries (CVEs Needed?)

Tim McLean discovered two serious (related) vulnerabilities common to  
several widely used JSON Web Token (JSW) libraries which he wrote about  
here [1] a month ago, and again today here [2].

A JWT is base64 encoded header, payload, and signature, where the header  
specifies the signature algorithm and an expiration timestamp.

The validation libraries running server side provide APIs such as;

   verify(string token, string secretKey)

The two critical bugs;

- Even when a secretKey was provided to the API, if the data in 'token'  
decoded to a header specifying a signature algorithm of *none*, the API  
would still return success. Meaning an attacker could just strip the  
signature, change the header, and bypass the signature validation  

- If the secretKey was expected to be a RSA public key, but the attacker  
changed the header to indicate a signature algorithm of HMAC, the RSA  
public key would be used as the signing secret.

Effected libraries include but probably not limited to:

php-jwt: Not yet patched?
jsjwt: Not yet patched?

I think these are all (possibly independently) CVE worthy... I requested  
Tim file CVEs here [3], but I haven't seen any to-date. I'm not sure about  
requesting CVEs on someone else's work, I'm just an interested bystander  

[1] -
[2] -
[3] -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.