ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
References
Link | Resource |
---|---|
https://forums.servicestack.net/t/servicestack-v5-9-2-released/8850 | Release Notes Vendor Advisory |
https://github.com/ServiceStack/ServiceStack/commit/540d4060e877a03ae95343c1a8560a26768585ee | Patch Third Party Advisory |
https://www.shielder.it/advisories/servicestack-jwt-signature-verification-bypass/ | Exploit Third Party Advisory |
https://www.shielder.it/blog/2020/11/re-discovering-a-jwt-authentication-bypass-in-servicestack/ | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2020-11-02 21:15
Updated : 2024-02-04 21:23
NVD link : CVE-2020-28042
Mitre link : CVE-2020-28042
CVE.ORG link : CVE-2020-28042
JSON object : View
Products Affected
servicestack
- servicestack
CWE
CWE-347
Improper Verification of Cryptographic Signature