QID 377890

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions prior to and including 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine.

Note: QID is kept potential because users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control.

Affected Versions:
jsonwebtoken 8.5.1 and versions prior to it.

QID Detection Logic (Authenticated):
This QID checks for vulnerable version of jsonwebtoken npm package installed globally. The QID runs the "npm list -g --silent" command to check for vulnerable version.

Note:
NPM packages can be installed anywhere as a developer/production dependency. This QID can only detect jsonwebtoken packages that are installed globally. For Microsoft Windows, this QID checks for installed packages within the '%systemdrive%\Users\Administrator' directory.

Successful exploitation of the vulnerability may allow an attacker to write arbitrary files to a system.