CVE-2022-39227
CRITICALpython-jwt < 3.3.4 - Authentication Bypass by Spoofing
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2022-39227. PoCs published by user0x1337, melikesraoz, NoSpaceAvailable.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2022-39227, which involves a JWT signature verification flaw in the python-jwt library versions < 3.3.4. The exploit allows an attacker to reuse a valid JWT signature with modified claims, effectively bypassing authentication.
Description
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
Exploits (3)
This repository contains a functional proof-of-concept exploit for CVE-2022-39227, which involves a JWT signature verification flaw in the python-jwt library versions < 3.3.4. The exploit allows an attacker to reuse a valid JWT signature with modified claims, effectively bypassing authentication.
This repository demonstrates CVE-2022-39227, a JWT authentication bypass vulnerability in python-jwt versions before 3.3.4. It includes a functional exploit that forges JWT claims without knowing the secret key, along with a vulnerable and patched version of the application for comparison.
This repository contains a functional proof-of-concept exploit for CVE-2022-39227, which exploits a flaw in the python-jwt library (< 3.3.4) allowing JWT signature reuse with modified claims. The PoC takes a valid JWT token and injects arbitrary claims while retaining the original signature.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N