JWT Algorithm Confusion in json-web-token library

The json-web-token JavaScript library is vulnerable to a JWT algorithm confusion attack. The vulnerability resides in line 86 of index.js, where the algorithm used for verifying a JWT token's signature is taken directly from the token's header before the token has been verified [1][2]. This means an attacker can craft a token that specifies a different algorithm than the one the server expects.

To exploit this, an attacker first needs to obtain the server's public RSA key, which can sometimes be recovered by observing multiple JWT tokens or other means. The attacker then creates a new JWT containing the HS256 algorithm in its header, signs it using the public RSA key as the HMAC secret, and presents it to the server. Since the library trusts the algorithm from the token, it will use the provided public key as an HMAC secret to verify the token, which will succeed [1][2].

The impact is that an attacker can forge arbitrary valid JWT tokens, potentially gaining unauthorized access to protected resources or privileges. For example, an attacker could modify the payload to set admin: true and have the server accept the token [2]. The attack is particularly effective when the server uses the RS256 algorithm, which is a common best practice, as the attacker can leverage the public key to sign the HS256 token.

Users of the library should upgrade to a patched version where the verification algorithm is hardcoded and not taken from the token. If no patch is available, a workaround is to ensure the server always validates that the token's algorithm matches an expected, trusted value before signature verification [1][2].