A vulnerability was found in the open source JsonWebToken (JWT) library. According to Palo Alto Networks Unit 42, CVE-2022-23529 it could allow an attacker to achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token request.
If an attacker is successful and runs malicious code on a server, they could overwrite arbitrary files on the host and use a poisoned secret key to perform many actions. To exploit the vulnerability and control the key, a threat actor will need to exploit a flaw within the secret management process. If successful, an attacker could gain access to confidential information and steal data.
JsonWebToken has over 10 million weekly downloads and is used by more than 22,000 projects. It is used by many open-source projects created by Microsoft, Salesforce, Intuit, IBM, Slack, Twilio, and others. Due to the library’s popularity and the potential for exploitation, Avertium recommends that users and organizations upgrade to JsonWebToken version 9.0.0 immediately.
Avertium recommends that organizations and users using JsonWebToken versions 8.5.1 and earlier apply the appropriate patch. You can find patch guidance here.
At this time, there are no known IoCs associated with CVE-2022-23529. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.