jwt-go up to 3.x Access Restriction privileges management

Summaryinfo

A vulnerability was found in jwt-go up to 3.x. It has been classified as critical. Affected is an unknown function of the component Access Restriction. This manipulation with the input []string{}/m["aud"] causes privileges management. The identification of this vulnerability is CVE-2020-26160. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in jwt-go up to 3.x and classified as critical. Affected by this vulnerability is an unknown code block of the component Access Restriction. The manipulation with the input value []string{}/m["aud"] leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

The weakness was shared 09/30/2020. This vulnerability is known as CVE-2020-26160 since 09/30/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 210539 (RHEL 8 : Red Hat OpenShift Container Storage 4.7 RPM (RHSA-2021:2042)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.0.0-preview1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210539). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• jwt-go

Version

• 3.x

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion