Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2018-0114 EUVD-2022-4353GHSA-jfxm-w8g2-4rcv

Cisco node-jose improper validation of JWT signature

Published Jan 4, 2018 · Updated Dec 2, 2024 · Assigned by cisco

Package: node-jose Ecosystem: npm

Description

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.

Affected products

VendorProductAffectedFixed
— Node-jose Library Node-jose Library —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 14 repositories · most starred shown

  • z-bool/Venom-JWT ★ 288 · Jan 27, 2025

    针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

  • zi0Black/POC-CVE-2018-0114 ★ 26 · Mar 20, 2018

    This repository contains the POC of an exploit for node-jose < 0.11.0

  • j4k0m/CVE-2018-0114 ★ 4 · Sep 3, 2021

    Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT.

  • scumdestroy/CVE-2018-0114 ★ 3 · May 11, 2021

    Exploit for Node-jose < 0.11.0 written in Ruby

  • Eremiel/CVE-2018-0114 ★ 2 · Jan 3, 2021

    python2.7 script for JWT generation

  • fevra-dev/ClaimJumper ★ 1 · Jan 16, 2026

    Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-specific attacks (CVE-2022-21449, CVE-2018-0…

  • adityathebe/POC-CVE-2018-0114 ★ 1 · Dec 20, 2020

    POC for CVE-2018-0114 written in Go

  • mmeza-developer/CVE-2018-0114 ★ 0 · Nov 6, 2021

    JWT Exploit

  • Starry-lord/CVE-2018-0114 ★ 0 · Jan 13, 2021
  • Logeirs/CVE-2018-0114 ★ 0 · Aug 18, 2020

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm node-jose < 0.11.0 0.11.0 GHSA-jfxm-w8g2-4rcv

References