CVE-2021-29455: Missing validation of JWT signature in `grassrootza/grassroot-platform`
Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29455?
CVE-2021-29455 is considered to have a medium severity due to its potential impact on token-based authentication.
How do I fix CVE-2021-29455?
To fix CVE-2021-29455, ensure that your Grassroot Platform version is updated to 1.3.1 or later, which properly verifies the signature of JSON Web Tokens.
What types of environments are affected by CVE-2021-29455?
CVE-2021-29455 affects any deployment of the Grassroot Platform prior to version 1.3.1.
What is the nature of the vulnerability described in CVE-2021-29455?
CVE-2021-29455 is a security flaw related to improper verification of JSON Web Tokens.
Can CVE-2021-29455 lead to unauthorized access?
Yes, CVE-2021-29455 can potentially allow attackers to bypass authentication mechanisms, leading to unauthorized access.