CVEs-PoC/2020/CVE-2020-28042.md

CVE-2020-28042

Description

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

POC

Reference

• https://www.shielder.it/advisories/servicestack-jwt-signature-verification-bypass/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/The-Cracker-Technology/jwt_tool
• https://github.com/crpytoscooby/resourses_web
• https://github.com/mishmashclone/ticarpi-jwt_tool
• https://github.com/phramz/tc2022-jwt101
• https://github.com/puckiestyle/jwt_tool
• https://github.com/ticarpi/jwt_tool
• https://github.com/zhangziyang301/jwt_tool