CVE-2024-34273: 
JavaScript vulnerability analysis and mitigation

The vulnerability (CVE-2024-34273) affects the nJwt library versions up to v0.4.0, specifically involving a prototype pollution vulnerability in the Parser.prototype.parse method. The issue was discovered and publicly disclosed on May 16, 2024 (NVD).

The vulnerability exists in the Parser.prototype.parse method, which is called when verifying JWT tokens using nJwt.verify(token, signingKey). The issue specifically affects JwtHeader and JwtBody objects, which lack proper validation to prevent attributes from being assigned to the object prototype. The vulnerability has been assigned CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and has received a CVSS v3.1 base score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub Advisory).

The vulnerability allows attackers to override existing attributes with incompatible types, potentially causing application crashes or bypassing security checks. Attackers can create polluted attributes on every object inheriting from JwtBody and JwtHeader objects, and bypass reserved key restrictions in the JwtHeader object by modifying the prototype's reservedKeys array (GitHub Advisory).

The vulnerability can be exploited by creating a JWT token with specially crafted header and body contents that include proto objects. These objects can modify the prototype chain and bypass existing security checks. A proof of concept exists demonstrating the successful exploitation of this vulnerability (GitHub Advisory).

The recommended mitigation is to either freeze the prototype or implement validation to check for prototype keywords (proto, constructor, and prototype). If these keywords are detected, the function should deny merging them into JwtBody and JwtHeader objects, thus preventing the prototype pollution vulnerability (GitHub Advisory).