Skip to main content

Incorrect Authorization

CVE-2020-15084

High
9.1/10

Summary

In express-jwt (NPM package) versions prior to 6.0.0, the "algorithms" entry to be specified in the configuration is not being enforced. When "algorithms" are not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: You are using express-jwt, you do not have "algorithms" configured in your express-jwt configuration, and you are using libraries such as jwks-rsa as the "secret". You can fix this by specifying "algorithms" in the express-jwt configuration. See the linked GHSA for example.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-863 - Incorrect Authorization

Authorization is a security mechanism performed by an application to grant or deny access to the requested resources by verifying the privileges of the user. When an application lacks effective authorization mechanisms, it enables unauthorized users to gain unintended privileges and illegitimate access to resources. Such a vulnerability may result in exposure of sensitive information, denial of service, arbitrary code execution, and complete system takeover.

References

Advisory Timeline

  • Published