CVE-2023-51774: JSON::JWT Ruby Gem Auth Bypass Vulnerability

CVE-2023-51774 Overview

CVE-2023-51774 is an authentication bypass vulnerability affecting the json-jwt (JSON::JWT) gem version 1.16.3 for Ruby. The vulnerability enables attackers to bypass identity checks through a sign/encryption confusion attack, where JSON Web Encryption (JWE) can be exploited to bypass the JSON::JWT.decode function.

Critical Impact
This vulnerability allows attackers to bypass authentication and identity verification mechanisms in Ruby applications that rely on the json-jwt gem for JWT processing, potentially leading to unauthorized access to protected resources and sensitive data.

Affected Products

json-jwt gem version 1.16.3 for Ruby
Applications using JSON::JWT for token validation
Ruby-based authentication systems implementing JWT verification

Discovery Timeline

2024-02-29 - CVE-2023-51774 published to NVD
2025-05-08 - Last updated in NVD database

Technical Details for CVE-2023-51774

Vulnerability Analysis

This vulnerability represents a cryptographic confusion attack where the json-jwt library fails to properly distinguish between signed tokens (JWS) and encrypted tokens (JWE). When an application expects a signed JWT token but receives a specially crafted JWE token instead, the JSON::JWT.decode function may incorrectly process the token, bypassing signature verification entirely.

The attack exploits a fundamental design flaw in how the library handles different JWT types. By crafting a JWE token that the library misinterprets, an attacker can forge identity claims without possessing the signing key. This type of confusion attack is particularly dangerous because it undermines the core security guarantees of JWT-based authentication systems.

Root Cause

The root cause of CVE-2023-51774 lies in improper access control (CWE-284) within the token type validation logic. The JSON::JWT.decode function does not adequately verify that the token type matches what the application expects, allowing encrypted tokens to be processed in contexts where signed tokens are required.

Attack Vector

The attack requires local access to craft and submit malicious tokens to a vulnerable application. An attacker would construct a JWE token containing forged identity claims and present it to an endpoint expecting a signed JWT. The vulnerable library processes this token without proper type validation, accepting the forged claims as legitimate.

The attack flow involves:

Identifying an application using the vulnerable json-jwt gem for authentication
Crafting a JWE token with malicious identity claims
Submitting the crafted token to bypass the JSON::JWT.decode verification
Gaining unauthorized access through the bypassed identity check

Technical details and proof-of-concept information can be found in the GitHub PoC Repository.

Detection Methods for CVE-2023-51774

Indicators of Compromise

Unexpected JWE tokens appearing in authentication logs where JWS tokens are expected
Authentication successes with tokens that have unusual header structures
Anomalous token processing patterns in application logs
Users gaining access to resources without proper authorization

Detection Strategies

Monitor JWT token headers for unexpected alg and enc values in authentication flows
Implement logging to detect tokens with JWE structure being processed as JWS tokens
Review authentication logs for successful logins with malformed or unexpected token types
Deploy runtime application security monitoring to detect confusion attack patterns

Monitoring Recommendations

Enable detailed logging of JWT processing including token type identification
Set up alerts for authentication anomalies where token structure doesn't match expected patterns
Monitor dependency usage to identify applications using json-jwt gem version 1.16.3
Implement security information and event management (SIEM) rules for JWT manipulation attempts

How to Mitigate CVE-2023-51774

Immediate Actions Required

Update the json-jwt gem to the latest patched version immediately
Audit all applications using json-jwt for JWT authentication
Implement explicit token type validation before processing JWTs
Review authentication logs for potential exploitation attempts

Patch Information

Organizations should update the json-jwt gem to a version that addresses this sign/encryption confusion vulnerability. Check the GitHub PoC Repository for specific version information and remediation guidance from the maintainers.

Workarounds

Implement explicit checks to verify token type (JWS vs JWE) before calling decode functions
Add application-level validation to ensure only expected token formats are accepted
Consider using alternative JWT libraries that properly handle token type discrimination
Implement additional authentication factors to reduce reliance on JWT validation alone

bash

# Check your Gemfile.lock for vulnerable json-jwt version
grep -E "json-jwt" Gemfile.lock

# Update to the latest json-jwt version
bundle update json-jwt

# Verify the updated version
bundle show json-jwt