Executive Summary

This vulnerability exists in LibJWT, a C JSON Web Token Library, specifically in versions starting from 3.0.0 up to but not including 3.3.0. The issue is in the JWK parsing for RSA-PSS keys, where the code did not properly handle NULL values when it expected JSON string values. An attacker could exploit this by crafting a JWK file that uses integers where strings are expected, potentially causing unexpected behavior.

This flaw was fixed in version 3.3.0. A workaround involves avoiding importing keys from untrusted JWK files and using the `jwk2key` tool to validate JWK files. It is also recommended to avoid using JWK files with RSA-PSS keys if possible.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability could lead to improper parsing of JWK files, which might allow an attacker to bypass expected validation or cause the application to behave incorrectly when handling RSA-PSS keys. This could potentially compromise the security of token verification or key handling processes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the validity of JWK files used for importing keys, especially those involving RSA-PSS keys. The recommended method is to use the `jwk2key` tool to verify the validity of a JWK file.

Users should look for JWK files that contain integers where strings are expected, as this is the core issue exploited by the vulnerability.

No specific network or system commands are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading LibJWT to version 3.3.0 or later, where the vulnerability has been fixed.

As a workaround, avoid importing keys through JWK files from untrusted sources.

If possible, avoid using JWK files with RSA-PSS keys until the library is updated.

Use the `jwk2key` tool to check the validity of JWK files before importing them.

Useful 0 Not Useful 0