CVE-2024-33663: Python-jose Algorithm Confusion Vulnerability

CVE-2024-33663 Overview

CVE-2024-33663 is an algorithm confusion vulnerability affecting python-jose through version 3.3.0. The vulnerability enables attackers to exploit key format confusion when handling OpenSSH ECDSA keys and other key formats, potentially allowing authentication bypass or signature forgery. This vulnerability is similar to CVE-2022-29217, which affected the PyJWT library with comparable algorithm confusion issues.

Critical Impact

Applications using python-jose for JWT validation may be vulnerable to authentication bypass through algorithm confusion attacks when processing OpenSSH ECDSA keys.

Affected Products

• python-jose versions through 3.3.0
• Applications using python-jose for JWT token validation
• Systems processing OpenSSH ECDSA key formats with python-jose

Discovery Timeline

• 2024-04-26 - CVE-2024-33663 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2024-33663

Vulnerability Analysis

This vulnerability falls under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and manifests through algorithm confusion in the JWT verification process. The core issue lies in how python-jose handles different key formats, particularly OpenSSH ECDSA keys. When an attacker can influence the key material used for verification, they may exploit the algorithm confusion to bypass signature validation entirely.

Algorithm confusion attacks against JWT libraries typically exploit the mismatch between asymmetric and symmetric signing algorithms. An attacker may craft a malicious JWT token that uses a symmetric algorithm (like HS256) with the public key as the secret, potentially allowing them to forge valid signatures when the application expects asymmetric verification (like RS256 or ES256).

Root Cause

The root cause stems from improper algorithm enforcement during JWT verification. When python-jose processes tokens, it may not adequately validate that the algorithm specified in the JWT header matches the expected algorithm type for the provided key. This allows an attacker to specify an unexpected algorithm in the token header that is compatible with the key material but not with the intended security model.

The vulnerability specifically affects scenarios involving OpenSSH ECDSA keys, where the key format parsing may allow for algorithm type confusion between ECDSA and other cryptographic operations.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Obtaining the public key used by the target application (often publicly available or leaked)
2. Crafting a malicious JWT with a modified algorithm header
3. Signing the token using the public key as a symmetric secret
4. Submitting the forged token to bypass authentication

The vulnerability mechanism involves manipulating the JWT header to specify a different algorithm than expected. For detailed technical analysis, see the Vicarius security blog post and the GitHub issue discussion.

Detection Methods for CVE-2024-33663

Indicators of Compromise

• JWT tokens with unexpected algorithm headers (e.g., HS256 when ES256 or RS256 is expected)
• Authentication logs showing successful token validation with mismatched algorithm types
• Unusual key format processing errors in application logs
• Attempts to access protected resources with tokens signed using public key material

Detection Strategies

• Implement logging for JWT algorithm headers and flag tokens using unexpected algorithms
• Monitor for authentication anomalies where users authenticate successfully with unusual token characteristics
• Deploy static code analysis to identify python-jose usage patterns vulnerable to algorithm confusion
• Review application configurations to ensure explicit algorithm enforcement is in place

Monitoring Recommendations

• Configure alerting for JWT validation attempts using symmetric algorithms when asymmetric is expected
• Monitor dependency inventory for python-jose versions 3.3.0 and earlier
• Track authentication patterns for anomalous successful validations following failed attempts
• Implement security event correlation to identify potential exploitation attempts across multiple services

How to Mitigate CVE-2024-33663

Immediate Actions Required

• Audit all applications using python-jose and inventory affected versions
• Implement explicit algorithm allowlists in JWT verification code to prevent algorithm confusion
• Consider migrating to alternative JWT libraries such as PyJWT or joserfc that have addressed similar vulnerabilities
• Review authentication logs for signs of attempted or successful exploitation

Patch Information

As of the last NVD update on 2025-09-02, organizations should monitor the python-jose GitHub repository for official patches and security advisories. The vulnerability affects versions through 3.3.0, and users should upgrade to any subsequent version that addresses CVE-2024-33663 once available.

Workarounds

• Explicitly specify allowed algorithms when calling JWT decode functions to prevent algorithm substitution
• Implement server-side validation to reject tokens with unexpected algorithm headers before verification
• Use separate key objects for different algorithm types to prevent key confusion
• Consider using asymmetric-only key handlers that reject symmetric algorithm specifications

# Recommended: Explicitly specify allowed algorithms
from jose import jwt

# Instead of allowing any algorithm, explicitly specify expected algorithms
allowed_algorithms = ["ES256"]  # Only allow the expected ECDSA algorithm

try:
    payload = jwt.decode(
        token,
        public_key,
        algorithms=allowed_algorithms  # Prevent algorithm confusion
    )
except jwt.JWTError as e:
    # Handle validation failure
    pass