Nimble Zta
Monthly
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). No public exploit code has been identified at time of analysis, but the flaw is remotely reachable with no authentication or user interaction (assessed CVSS 3.1 base 9.3, scope changed) and is fixed in nimble_zta 0.1.3.
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). No public exploit code has been identified at time of analysis, but the flaw is remotely reachable with no authentication or user interaction (assessed CVSS 3.1 base 9.3, scope changed) and is fixed in nimble_zta 0.1.3.