CVE-2023-51774: 
Ruby vulnerability analysis and mitigation

The json-jwt (aka JSON::JWT) gem version 1.16.3 for Ruby contains a vulnerability that allows bypass of identity checks through a sign/encryption confusion attack. The vulnerability was discovered in late 2023 and affects applications using the JSON::JWT.decode functionality (GitHub PoC).

The vulnerability exists in the JSON::JWT.decode function which automatically determines whether a token belongs to JWS (JSON Web Signature) or JWE (JSON Web Encryption). When developers use RS-* signing algorithms and an attacker has access to the public key, a sign/encryption confusion attack becomes possible. This occurs because the decoder fails to properly validate the token type, allowing JWE tokens to bypass checks intended for JWS tokens (GitHub PoC).

The vulnerability could allow attackers to bypass identity checks and authentication mechanisms in applications using the affected json-jwt gem version. This could potentially lead to unauthorized access and privilege escalation in affected systems (NVD).

The vulnerability requires the attacker to have access to the public key used for RS-* signing algorithms. With this prerequisite met, an attacker can craft specially formatted JWE tokens to bypass the intended security checks in the JSON::JWT.decode function (GitHub PoC).

Users of the json-jwt gem should upgrade to a version newer than 1.16.3 when available. Until then, additional validation should be implemented to explicitly verify token types before processing (NVD).