CVE-2024-53861

pyjwt <2.10.1 has an insecure `iss` claim check due to incorrect string comparison, allowing `"acb"` to pass for `"_abc_"`, causing potential denial of service. Upgrade to 2.10.1.

• CVSS 7.5
• CWE-697
• Design Defects
• Remote

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2024-53861

CWE

CWE-697

CVSS base score

7.5

Published

2024-11-29

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Design Defects

Subcategory

Authentication, Authorization, and Sessio

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

pyjwt

Fixed by upgrading

Yes

Solution

Upgrade pyjwt to version 2.10.1 or later.

from pyjwt import PyJWT
from collections.abc import Sequence

def verify_token(token, issuer):
    try:
        payload = PyJWT().decode(token, 'secret', algorithms=['HS256'])

        if isinstance(issuer, Sequence):
            if issuer not in payload.get('iss', ''):
                raise ValueError("Invalid issuer")
        elif payload['iss'] != issuer:
            raise ValueError("Invalid issuer")


        return payload
    except Exception as e:
        return None


token = PyJWT().encode({'iss': '_abc_', 'test': 'test'}, 'secret', algorithm='HS256')
print(verify_token(token, "acb"))

import jwt
from collections.abc import Sequence

def verify_token(token, issuer):
    try:
        payload = jwt.decode(token, 'secret', algorithms=['HS256'])

        if isinstance(issuer, Sequence):
            if payload.get('iss') not in issuer:
                raise ValueError("Invalid issuer")
        elif payload.get('iss') != issuer:
            raise ValueError("Invalid issuer")

        return payload

    except jwt.ExpiredSignatureError:
        print("Token has expired.")
        return None
    except jwt.InvalidTokenError:
        print("Invalid token.")
        return None
    except ValueError as e:
        print(f"Error: {e}")
        return None
    except Exception as e:
        print(f"Unexpected error: {e}")
        return None


token = jwt.encode({'iss': '_abc_', 'test': 'test'}, 'secret', algorithm='HS256')
print(verify_token(token, "acb"))

{
  "iss": "acb",
  "payload": "some data"
}

@misc{vaitp:cve202453861,
  title        = {{pyjwt <2.10.1 has an insecure `iss` claim check due to incorrect string comparison, allowing `"acb"` to pass for `"_abc_"`, causing potential denial of service.  Upgrade to 2.10.1.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-53861},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-53861/}}
}