Vulnerabilities in pkg:npm/express-jwt

PACKAGE
Advisory Identifier: GHSA-6g6m-m6h5-w9gf
Share
Advisory Summary

CVE-2020-15084 is a HIGH (CVSS 7.7) authorization bypass vulnerability (CWE-285: Improper Authorization) affecting Express jwt libraries in the npm ecosystem. The issue involves authorization bypass in express-jwt. Remediation is available by upgrading affected packages to version 6.0.0.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/express-jwt

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/express-jwt. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-6g6m-m6h5-w9gf CVE-2020-15084 HIGH Authorization bypass in express-jwt

CVE-2020-15084 at a Glance

CVE Identifier CVE-2020-15084
GHSA Identifier GHSA-6g6m-m6h5-w9gf
Severity HIGH
CVSS v3.1 Base Score 7.7
CWE Classification CWE-285: Improper Authorization
Affected Product Express jwt
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 7.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2020-15084

To remediate this vulnerability, upgrade all affected Express jwt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

express-jwt fixed: 6.0.0 
npm install express-jwt@6.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls express-jwt

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2020-15084, inspect your project dependencies using npm:

npm ls express-jwt

Analyze the terminal output to locate any version of Express jwt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.0.0), your application is affected.

Note: The npm ls express-jwt command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Express jwt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Overview Versions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration. When **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. ### Am I affected? You are affected by this vulnerability if all of the following conditions apply: You are using express-jwt AND You do not have **algorithms** configured in your express-jwt configuration. AND You are using libraries such as jwks-rsa as the **secret**. ### How to fix that? Specify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration ``` const checkJwt = jwt({ secret: jwksRsa.expressJwtSecret({ rateLimit: true, jwksRequestsPerMinute: 5, jwksUri: `https://${DOMAIN}/.well-known/jwks.json` }), // Validate the audience and the issuer. audience: process.env.AUDIENCE, issuer: `https://${DOMAIN}/`, // restrict allowed algorithms algorithms: ['RS256'] }); ``` ### Will this update impact my users? The fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. ### Credit IST Group

CVE-2020-15084 Affected Express jwt Versions

1 component(s)
Fixed Versions:
6.0.0
Product / Package Ecosystem Affected Versions Fixed Version
express-jwt
npm/express-jwt
npm
< 6.0.0
6.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
NVD — CVE-2020-15084 NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15084
Security Fix Commit FIX COMMIT
https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef

Frequently Asked Questions

What is CVE-2020-15084?
CVE-2020-15084 is a security vulnerability in Express jwt involving Authorization bypass in express-jwt under CWE-285: Improper Authorization.
Which Express jwt versions are affected?
Affected versions include releases prior to 6.0.0 across affected packages: express-jwt.
What version fixes CVE-2020-15084?
Upgrading to 6.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is express-jwt affected?
Yes, express-jwt is affected in releases prior to 6.0.0. Upgrade your dependency to 6.0.0 or later.
What is the CVSS score of CVE-2020-15084?
CVE-2020-15084 has a CVSS v3.1 base score of 7.7 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
What CWE is associated with CVE-2020-15084?
CVE-2020-15084 is classified under CWE-285: Improper Authorization (The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.).
How can I check npm dependencies for CVE-2020-15084?
Run the dependency tree command: 'npm ls express-jwt'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g6m-m6h5-w9gf",
  "modified" : "2021-01-07T23:49:22Z",
  "published" : "2020-06-30T16:05:24Z",
  "aliases" : [ "CVE-2020-15084" ],
  "summary" : "Authorization bypass in express-jwt",
  "details" : "### Overview\nVersions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.\nWhen **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. \n\n### Am I affected?\nYou are affected by this vulnerability if all of the following conditions apply:\n\nYou are using express-jwt\nAND \nYou do not have **algorithms**  configured in your express-jwt configuration.\nAND\nYou are using libraries such as jwks-rsa as the **secret**. \n\n### How to fix that?\nSpecify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration\n\n``` \nconst checkJwt = jwt({\n  secret: jwksRsa.expressJwtSecret({\n    rateLimit: true,\n    jwksRequestsPerMinute: 5,\n    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`\n  }),\n  // Validate the audience and the issuer.\n  audience: process.env.AUDIENCE,\n  issuer: `https://${DOMAIN}/`,\n  // restrict allowed algorithms\n  algorithms: ['RS256']\n}); \n```\n\n### Will this update impact my users?\nThe fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. \n\n\n### Credit\nIST Group",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "express-jwt"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.3.3"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-15084"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-30T16:04:48Z",
    "nvd_published_at" : "2020-06-30T16:15:00Z"
  }
}