Giters

auth0 / node-jwks-rsa

A library to retrieve RSA public keys from a JWKS (JSON Web Key Set) endpoint.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Please upgrade dependencies

icco opened this issue · comments

commented

Checklist

  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

The dependency jsonwebtoken has three medium security vulns this package brings in.

  • jsonwebtoken unrestricted key type could lead to legacy keys usage - GHSA-8cf7-32gw-wr33
  • jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - GHSA-hjrf-2m68-5959
  • jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - GHSA-qwph-4952-7xr6

You are also using two type stubs which are polluting the dependency tree: @types/express-jwt and @types/nock

Finally you are using many outdated and unsupported packages, including very old versions of superagent and formidible.

Reproduction

  1. Run npm i - shows warnings of stub packages
  2. Run npm audit - shows all vulnerable packages
  3. Run npm outdated - shows all outdated packages

Additional context

No response

jwks-rsa version

Node.js version

commented

I attempted to do this in https://github.com/auth0/node-jwks-rsa/pull/365/files but could not get the tests to pass.

commented

Hi @icco - thanks for raising this

The dependency jsonwebtoken has three medium security vulns this package brings in.

This dependency (same with superagent and formidible) are dev dependencies, used in testing - so this library doesn't bring any of them in when you install this package.

Also, the version of jsonwebtoken that it uses in its testing has been patched for the vulnerabilities you've mentioned

I attempted to do this in #365 (files) but could not get the tests to pass.

Thank you for attempting to update the dev dependencies, we'll take a look at updating them shortly

commented

Hmm, npm (and various security scanners such as snyk and sonatype) think the jsonwebtoken dependency is bringing vulnerabilities into this package.

I wonder if there's some weird dependency resolution happening because of the multiple versions of express-jwt in dev

commented

Don't see any issues in Snyk https://snyk.io/advisor/npm-package/jwks-rsa - let me investigate further

commented

Ah ok, it looks like they're being picked up in the example packages eg https://github.com/auth0/node-jwks-rsa/tree/2fd4582d2be5f3e4fd6ed0d6f2d8bd7103f7434d/examples/koa-demo

I'll make sure we update them when we update the dev dependencies