CVE-2022-23540 PoC — jsonwebtoken 数据伪造问题漏洞

Source

https://github.com/jsirichai/CVE-2022-23540-PoC

Associated Vulnerability

Title:jsonwebtoken 数据伪造问题漏洞 (CVE-2022-23540)
Description:jsonwebtoken是Auth0开源的一个 JSON Web 令牌的实现。 jsonwebtoken 8.5.1版本及之前版本存在数据伪造问题漏洞，该漏洞源于默认使用“none”算法进行签名验证，jwt.verify 函数中缺少算法定义，可能会导致绕过签名验证。

Description

CVE-2022-23540 - jwt.verify() method

File Snapshot


 [4.0K]  /data/pocs/e6f733390e17bbbb078edece98f95c3efde3e5be

0 directories, 0 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!