CVE-2020-10594 Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Attackers can use invalidated tokens to obtain new valid tokens via the refresh endpoint, bypassing blacklist protections in drf-jwt.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10594?
CVE-2020-10594 is a critical authentication bypass vulnerability in n/a, published on 15 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
Weakness: CWE-287
Which versions are affected by CVE-2020-10594?
3 open source packages ship an affected version, including drf-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drf-jwt PyPI | From 1.15.0 | 1.15.1 |
drf-jwt PyPI | From 1.15.0 | 1.15.1 |
drf-jwt PyPI | From 1.15.0 | 1.15.1 |
Products include Styria Django-Rest-Framework-Json Web Tokens.
How do I fix CVE-2020-10594?
Upgrade drf-jwt to 1.15.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-10594 being exploited?
There is no known exploitation of CVE-2020-10594 in the wild and no public exploit code.
Sources
Also known as GHSA-fpjm-rp2g-3r4c, PYSEC-2020-40.