CVE-2021-29455 Missing validation of JWT signature in `grassrootza/grassroot-platform`
Attackers can forge valid JWTs due to missing signature verification during token refresh, enabling unauthorized access and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29455?
CVE-2021-29455 is a high-severity authentication bypass vulnerability in grassrootza grassroot-platform, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).
Weakness: CWE-347
Which versions are affected by CVE-2021-29455?
It affects 1 product.
Products include Grassroot Grassroot Platform.
How do I fix CVE-2021-29455?
No fix has been published for CVE-2021-29455 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-29455 being exploited?
There is no known exploitation of CVE-2021-29455 in the wild and no public exploit code.