HMAC Key Validation Bypass in python-jose

Executive Summary

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization. It accepts DER-encoded public keys without PEM armor or SSH prefixes. Attackers with the service's public key can forge HS256 tokens that pass verification if algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect python-jose versions for 3.5.0 or earlier. Check if your application uses HMAC algorithms without explicit algorithm allowlisting. Review token verification logic for improper handling of DER-encoded public keys as HMAC secrets.

Useful 0 Not Useful 0

Impact Analysis

If you use python-jose and do not restrict allowed algorithms, attackers could forge tokens to bypass authentication or authorization. This may allow unauthorized access to sensitive data or functions in your application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update python-jose to the latest version beyond 3.5.0 to ensure proper validation of asymmetric keys. Explicitly restrict allowed algorithms in token verification to prevent HS256 forgery.

Useful 0 Not Useful 0