CVE-2023-51774: JSON::JWT Ruby Gem Auth Bypass Vulnerability

CVE-2023-51774 Overview

CVE-2023-51774 is an authentication bypass vulnerability affecting the json-jwt (JSON::JWT) gem version 1.16.3 for Ruby. The vulnerability enables attackers to bypass identity checks through a sign/encryption confusion attack, where JSON Web Encryption (JWE) can be exploited to bypass the JSON::JWT.decode function.

Critical Impact

This vulnerability allows attackers to bypass authentication and identity verification mechanisms in Ruby applications that rely on the json-jwt gem for JWT processing, potentially leading to unauthorized access to protected resources and sensitive data.

Affected Products

• json-jwt gem version 1.16.3 for Ruby
• Applications using JSON::JWT for token validation
• Ruby-based authentication systems implementing JWT verification

Discovery Timeline

• 2024-02-29 - CVE-2023-51774 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2023-51774

Vulnerability Analysis

This vulnerability represents a cryptographic confusion attack where the json-jwt library fails to properly distinguish between signed tokens (JWS) and encrypted tokens (JWE). When an application expects a signed JWT token but receives a specially crafted JWE token instead, the JSON::JWT.decode function may incorrectly process the token, bypassing signature verification entirely.

The attack exploits a fundamental design flaw in how the library handles different JWT types. By crafting a JWE token that the library misinterprets, an attacker can forge identity claims without possessing the signing key. This type of confusion attack is particularly dangerous because it undermines the core security guarantees of JWT-based authentication systems.

Root Cause

The root cause of CVE-2023-51774 lies in improper access control (CWE-284) within the token type validation logic. The JSON::JWT.decode function does not adequately verify that the token type matches what the application expects, allowing encrypted tokens to be processed in contexts where signed tokens are required.

Attack Vector

The attack requires local access to craft and submit malicious tokens to a vulnerable application. An attacker would construct a JWE token containing forged identity claims and present it to an endpoint expecting a signed JWT. The vulnerable library processes this token without proper type validation, accepting the forged claims as legitimate.

The attack flow involves:

1. Identifying an application using the vulnerable json-jwt gem for authentication
2. Crafting a JWE token with malicious identity claims
3. Submitting the crafted token to bypass the JSON::JWT.decode verification
4. Gaining unauthorized access through the bypassed identity check

Technical details and proof-of-concept information can be found in the GitHub PoC Repository.

Detection Methods for CVE-2023-51774

Indicators of Compromise

• Unexpected JWE tokens appearing in authentication logs where JWS tokens are expected
• Authentication successes with tokens that have unusual header structures
• Anomalous token processing patterns in application logs
• Users gaining access to resources without proper authorization

Detection Strategies

• Monitor JWT token headers for unexpected alg and enc values in authentication flows
• Implement logging to detect tokens with JWE structure being processed as JWS tokens
• Review authentication logs for successful logins with malformed or unexpected token types
• Deploy runtime application security monitoring to detect confusion attack patterns

Monitoring Recommendations

• Enable detailed logging of JWT processing including token type identification
• Set up alerts for authentication anomalies where token structure doesn't match expected patterns
• Monitor dependency usage to identify applications using json-jwt gem version 1.16.3
• Implement security information and event management (SIEM) rules for JWT manipulation attempts

How to Mitigate CVE-2023-51774

Immediate Actions Required

• Update the json-jwt gem to the latest patched version immediately
• Audit all applications using json-jwt for JWT authentication
• Implement explicit token type validation before processing JWTs
• Review authentication logs for potential exploitation attempts

Patch Information

Organizations should update the json-jwt gem to a version that addresses this sign/encryption confusion vulnerability. Check the GitHub PoC Repository for specific version information and remediation guidance from the maintainers.

Workarounds

• Implement explicit checks to verify token type (JWS vs JWE) before calling decode functions
• Add application-level validation to ensure only expected token formats are accepted
• Consider using alternative JWT libraries that properly handle token type discrimination
• Implement additional authentication factors to reduce reliance on JWT validation alone

# Check your Gemfile.lock for vulnerable json-jwt version
grep -E "json-jwt" Gemfile.lock

# Update to the latest json-jwt version
bundle update json-jwt

# Verify the updated version
bundle show json-jwt