Strategic Overview
- Status
- Patched in 2.1.1
- Affected Plugin
- JWT Auth – WordPress JSON Web Token Authentication
- Affected Version
<= 2.1.0- CVSS
- 9.1Critical
- Weakness type
- CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
- CVE
CVE-2021-46743
At a glance
CVE-2021-46743 is a critical-severity Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in the JWT Auth WordPress plugin, affecting versions <= 2.1.0. It carries a CVSS score of 9.1 (reachable over the network; low attack complexity; high confidentiality, integrity impact). Exploitation requires no authentication. The issue is fixed in version 2.1.1; sites on affected versions should update now. Disclosed November 2022.
Vulnerability Overview
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. This may or may not be exploitable in WordPress plugins and themes using the library.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity.
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Remediation
Update to version 2.1.1, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: JWT Auth 2.1.1 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C