CVE-2023-40171

Summary

CVE-2023-40171 is a vulnerability affecting Dispatch, an open-source security incident management tool. The issue lies with the `Dispatch Plugin - Basic Authentication Provider`, which inadvertently discloses the JWT Secret Key in error messages when attempting to decode a JWT token. This secret key is used for signing JWT tokens, making any Dispatch instances relying on this plugin for authentication susceptible to account takeover attacks. An attacker could sign malicious JWTs using the exposed secret key. This vulnerability has been patched in commit `b1942a4319`, which is part of the `20230817` release. It is highly recommended for affected users to rotate their `DISPATCH_JWT_SECRET` envvar in the `.env` file and upgrade to the latest version. No known workarounds exist for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.