[🐸 Frogbot] Upgrade jsonwebtoken to 9.0.0

[github-actions]

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY	CONTEXTUAL ANALYSIS	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS	CVES
High	Undetermined	jsonwebtoken:8.5.1 express-jwt:5.3.3	jsonwebtoken 8.5.1	[9.0.0]	CVE-2022-23540

🔬 Research Details

Description:
jsonwebtoken is a JSON Web Token (JWT) implementation for Node.js.
It allows verifying/signing JWTs, which are mainly used for authorization and authentication purposes.

JSON Web Token is an open industry standard used to share information between two entities, usually a client (like your app’s frontend) and a server (your app’s backend).
Each JWT is also signed using cryptography (hashing) to ensure that the JSON contents (also known as JWT claims) cannot be altered by the client or a malicious party.

It was discovered that the jwt.verify() function in jsonwebtoken defaults to an empty signature validation, which leads to a JWT's signature bypass.

The issue occurs when not specifying any validation algorithm in the options parameter for the jwt.verify() function and in addition the secretOrPublicKey argument is falsy (null, false, or undefined). In this case, a malicious attacker can send an unsigned JSON Web Token using the none validation algorithm, essentially bypassing the signature check altogether.

Remediation:

Development mitigations

To mitigate this issue, specify the allowed algorithms to the jwt.verify() function, and make sure not to use the none algorithm (that will allow unsigned tokens and hence this vulnerability).

An example for a secure call to jwt.verify():

jwt.verify(token, key, { algorithms: ['RS256'] });

---

🐸 JFrog Frogbot