CVE-2017-11424

What it actually does

The invalid_strings check in HMACAlgorithm.prepare_key fails to reject PKCS1 PEM-encoded public keys (prefaced by -----BEGIN RSA PUBLIC KEY-----), allowing an attacker to treat an asymmetric public key as a symmetric HMAC secret and forge arbitrary JWTs.

Why it matters to the business

Attackers can impersonate any user or bypass authentication controls in applications that accept PKCS1 PEM public keys for JWT verification, leading to unauthorized access, data exposure, or privilege escalation with minimal attacker effort.

How an attack unfolds

An attacker obtains or guesses the RSA public key used by the target application, crafts a JWT header and payload, signs it using the public key bytes as an HMAC secret, and submits the token to endpoints that rely on PyJWT <=1.5.0 for verification.

How to fix it

Upgrade affected Go packages (go-1.20, go-1.20-doc and variants on Chainguard and Wolfi) to the versions listed as fixed (0); organizations using PyJWT should migrate to a version newer than 1.5.0 and ensure only PKCS8 or SPKI PEM formats are accepted.

How to confirm the fix worked

Confirm the deployed package versions match the fixed entries, review JWT verification code to ensure only approved PEM formats are permitted, and test that PKCS1 keys are now rejected during key preparation.

Typical attack path

1. Discover application endpoints that accept JWT authentication
2. Extract or obtain the PKCS1 PEM public key configured for verification
3. Construct a forged JWT using the public key material as the HMAC signing key
4. Submit the forged token to the application to impersonate users or escalate privileges

How to detect it

Search application and authentication logs for JWTs whose signature was generated with an RSA public key treated as an HMAC secret; look for tokens containing RSA key material in the signature field or repeated use of the same public-key-derived signature across different claims.

What your security team should do

• Prioritize inventory of all applications using JWT libraries and confirm current package versions
• Apply the listed fixed package versions immediately where the vulnerable code paths are reachable
• Add runtime checks or library configuration to reject PKCS1 PEM keys until upgrades are complete
• Monitor for unusual JWT acceptance patterns or authentication anomalies during the remediation window