CVE-2023-48238

Summary

CVE-2023-48238 is a vulnerability affecting the joaquimserafim/json-web-token library used for interacting with JSON Web Tokens (JWT). The library, which is used to represent claims between parties, is susceptible to a JWT algorithm confusion attack due to an untrusted algorithm selection process. The attacker can exploit this vulnerability by crafting a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This will only work if the RS256 algorithm is in use, which is a best practice for JWT signature verification. The vulnerability arises because the algorithm to use for verifying the JWT signature is taken from the token itself before it is verified, making it untrustworthy.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.