Input validation error in node-jsonwebtoken - CVE-2022-23529

Vulnerability identifier: #VU71185

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23529

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in jwt.verify function. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

node-jsonwebtoken
QRadar Suite
strapi
Event Streams
IBM Integration Bus
IBM Cloud Pak for Business Automation
Spectrum Discover
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Maximo Application Suite
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Security Verify Information Queue
IBM Watson Machine Learning Accelerator
IBM App Connect Enterprise

Install updates from vendor's website.

node-jsonwebtoken - update to 9.0.0
QRadar Suite - update to 1.10.18.0
strapi - update to 4.5.6
Event Streams - update to 11.1.4
IBM Security Verify Information Queue - update to 10.0.5
IBM App Connect Enterprise - update to 11.0.0.20
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Watson Machine Learning Accelerator - addressed in versions 2.2.6, 2.3.5, 3.1.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.6.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.3
Data Replication on Cloud Pak for Data - update to 4.6.5
IBM Maximo Application Suite - addressed in versions 8.8.7, 8.9.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-5

• Exploit #8782 - CVE-2022-23529-Exploration (CVE-2022-23529-PoC) (January 31, 2023)
• Exploit #8744 - CVE-2022-23529-PoC (CVE-2022-23529-PoC) (January 16, 2023)

• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-27h2-hvpr-p74q
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3

• Multiple vulnerabilities in node-jsonwebtoken
• Multiple vulnerabilities in strapi
• Input validation error in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Decision Optimization in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Suite Software