CVEs-PoC/2020/CVE-2020-28042.md

### [CVE-2020-28042](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28042)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

### POC

#### Reference
- https://www.shielder.it/advisories/servicestack-jwt-signature-verification-bypass/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/The-Cracker-Technology/jwt_tool
- https://github.com/crpytoscooby/resourses_web
- https://github.com/mishmashclone/ticarpi-jwt_tool
- https://github.com/phramz/tc2022-jwt101
- https://github.com/puckiestyle/jwt_tool
- https://github.com/ticarpi/jwt_tool
- https://github.com/zhangziyang301/jwt_tool