CVE-2019-7644 Critical severity vulnerability that affects Auth0-WCF-Service-JWT
An attacker can forge arbitrary JWT tokens by extracting the expected signature from error messages, bypassing authentication in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-7644?
CVE-2019-7644 is a critical vulnerability in n/a, published on 11 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.
Weakness: CWE-209
Which versions are affected by CVE-2019-7644?
2 open source packages ship an affected version, including Auth0-WCF-Service-JWT. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Auth0-WCF-Service-JWT NuGet | All versions | 1.0.4 |
Auth0-WCF-Service-JWT NuGet | All versions | 1.0.4 |
Products include Auth0 Auth0-Wcf-Service-Jwt.
How do I fix CVE-2019-7644?
Upgrade Auth0-WCF-Service-JWT to 1.0.4 or later.
Is CVE-2019-7644 being exploited?
There is no known exploitation of CVE-2019-7644 in the wild and no public exploit code.
Sources
Also known as GHSA-qpvx-gpqm-g98j.