Vulnerability · Published Sep 28, 2021 · Assigned by GitHub_M
CVE-2021-41106File reference keys leads to incorrect hashes on HMAC algorithms
Medium 4.4
In plain English
A medium-severity insufficient verification of data authenticity in jwt from lcobucci. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents. The HMAC hashing functions take any string as input and, since users can issue and validate tokens, users are lead to believe that everything works properly. Versions 3.4.6, 4.0.4, and 4.1.5 have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative. As a workaround, use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of one's keys.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | lcobucci/jwt | 3.4.6 | GHSA-7322-jrq4-x5hf |
| Packagist | lcobucci/jwt | 4.0.4 | GHSA-7322-jrq4-x5hf |
| Packagist | lcobucci/jwt | 4.1.5 | GHSA-7322-jrq4-x5hf |
Affected products (as reported)
Weakness: CWE-345 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N