CVE-2023-48238

json-web-token library is vulnerable to a JWT algorithm confusion attack

const express = require('express');
const jwt = require('json-web-token');
const fs = require('fs');
const path = require('path');

const app = express();
const port = 3000;

// Load the keys from the file
const publicKeyPath = path.join(__dirname, 'public-key.pem');
const publicKey = fs.readFileSync(publicKeyPath, 'utf8');
const privateKeyPath = path.join(__dirname, 'private-key.pem');
const privateKey = fs.readFileSync(privateKeyPath, 'utf8');

app.use(express.json());

// Endpoint to generate a JWT token with admin: False
app.get('/generateToken', async (req, res) => {
  const payload = { admin: false, name: req.query.name };
  const token = await jwt.encode(privateKey, payload, 'RS256', function (err, token) {
    res.json({ token });
  });
});

// Middleware to verify the JWT token
function verifyToken(req, res, next) {
  const token = req.query.token;

  jwt.decode(publicKey, token, (err, decoded) => {
    if (err) {
      console.log(err)
      return res.status(401).json({ message: 'Token authentication failed' });
    }

    req.decoded = decoded;
    next();
  });
}

// Endpoint to check if you are the admin or not
app.get('/checkAdmin', verifyToken, (req, res) => {
  res.json(req.decoded);
});

app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

python3 jwt_forgery.py token1 token2

python /opt/jwt_tool/jwt_tool.py --exploit k -pk public_key token

Applications using the RS256 algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads that the verifier will accept.

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

CVE-2023-48238 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.0.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Either one of the following solutions will work.

1. Change the signature of the decode function to ensure that the algorithm is set in that call
2. Check whether or not the secret could be a public key in the decode function and in that case, set the key to be a public key.

Fixed in 4.0.0. Both encode and decode now reject combinations where the key type (PEM vs plain secret) doesn't match the algorithm family. Upgrade with npm install json-web-token@^4.

1. What is CVE-2023-48238? CVE-2023-48238 is a high-severity improper input validation vulnerability in json-web-token (npm), affecting versions <= 3.1.1. It is fixed in 4.0.0. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. How severe is CVE-2023-48238? CVE-2023-48238 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of json-web-token are affected by CVE-2023-48238? json-web-token (npm) versions <= 3.1.1 is affected.
4. Is there a fix for CVE-2023-48238? Yes. CVE-2023-48238 is fixed in 4.0.0. Upgrade to this version or later.
5. Is CVE-2023-48238 exploitable, and should I be worried? Whether CVE-2023-48238 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-48238 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-48238? Upgrade json-web-token to 4.0.0 or later.