Skip to content
OpenAdvisories
Critical Public exploit CVE-2016-10555 EUVD-2018-0779GHSA-vgrx-w6rg-8fqf

Forgeable Public/Private Tokens in jwt-simple

Published May 31, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Vendor: HackerOne Product: jwt-simple node module Package: jwt-simple Ecosystem: npm

Description

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.

Affected products

VendorProductAffectedFixed
HackerOne jwt-simple node module <=0.3.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • z-bool/Venom-JWT ★ 288 · Jan 27, 2025

    针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

  • CircuitSoul/poc-cve-2016-10555 ★ 1 · Jun 14, 2021

    Change the algorithm RS256(asymmetric) to HS256(symmetric) - POC (CVE-2016-10555)

  • scent2d/PoC-CVE-2016-10555 ★ 0 · Jan 2, 2022

    CVE-2016-10555 PoC code

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm jwt-simple < 0.3.1 0.3.1 GHSA-vgrx-w6rg-8fqf

References