CVE-2023-48238
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-48238 is a vulnerability affecting the joaquimserafim/json-web-token library used for interacting with JSON Web Tokens (JWT). The library, which is used to represent claims between parties, is susceptible to a JWT algorithm confusion attack due to an untrusted algorithm selection process. The attacker can exploit this vulnerability by crafting a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This will only work if the RS256 algorithm is in use, which is a best practice for JWT signature verification. The vulnerability arises because the algorithm to use for verifying the JWT signature is taken from the token itself before it is verified, making it untrustworthy.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions