CVE-2024-53861

Executive Summary

CVE-2024-53861 is a low-severity (CVSS 2.2) vulnerability in the PyJWT library (versions 2.10.0 only) that affects the validation of the iss (issuer) claim in JSON Web Tokens. The flaw stems from an incorrect type check change in version 2.10.0, where isinstance(issuer, list) was replaced with isinstance(issuer, Sequence). Since str is a Sequence, the subsequent in operator performs substring matching instead of exact equality. This allows an attacker to craft a JWT with an iss value that is a substring of the expected issuer (e.g., "acb" accepted for "_abc_"). Signature verification remains intact, so the primary real-world impact is limited to denial of service (DoS) scenarios where token validation logic can be bypassed for issuer checks, potentially leading to authentication bypass in systems that rely solely on iss validation without signature checks.

Supply Chain & Package Security

This vulnerability affects the PyJWT package, distributed via PyPI. Users of PyJWT 2.10.0 are at risk. The package is widely used in Python applications for JWT handling. The supply chain risk is moderate due to the narrow version range and low severity, but organizations should verify their dependency trees for any pinned version 2.10.0.

CVSS Breakdown & Threat Level

• CVSS Score: 2.2 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be triggered remotely.
• Attack Complexity: High (AC:H) – Exploitation requires crafting a JWT with a specific iss substring and bypassing signature checks (which remain intact).
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – Potential for DoS if token validation logic is disrupted.

Deep Dive & Mechanics

The vulnerability is introduced in PyJWT version 2.10.0. The change from isinstance(issuer, list) to isinstance(issuer, Sequence) is the root cause. In Python, str is a Sequence (it implements __getitem__ and __len__), so when the iss claim is a string, the code enters the branch intended for sequences. The subsequent check uses the in operator, which for strings performs substring matching. For example, if the expected issuer is "_abc_", a token with iss: "acb" would pass because "acb" in "_abc_" is False (note: the example in the description is illustrative; the actual substring check would be "acb" in "_abc_" which is False, but the logic is inverted – the check is if "abc" not in "__abcd__": which would incorrectly accept "abc" as a substring). The correct behavior should be exact string equality using !=.

The signature verification is still performed, so an attacker cannot forge arbitrary tokens. However, if an application relies solely on iss validation (e.g., for routing or logging), an attacker could bypass issuer checks by providing a token with a substring iss value.

Vulnerable vs. Patched Code

Vulnerable (2.10.0):

if isinstance(issuer, Sequence):
    if token_iss not in issuer:
        raise InvalidIssuerError("Issuer is invalid")

Patched (2.10.1):

if isinstance(issuer, list):
    if token_iss not in issuer:
        raise InvalidIssuerError("Issuer is invalid")
elif isinstance(issuer, str):
    if token_iss != issuer:
        raise InvalidIssuerError("Issuer is invalid")

The patch restores the original list check and adds a separate str check with exact equality.

Exploitation & Lab Setup

Red Team

Prerequisites:

• PyJWT version 2.10.0 installed.
• A target application that validates JWT iss claim using PyJWT.

Exploitation Steps:

1. Obtain a valid JWT from the target (or craft one if signature is known).
2. Modify the iss claim to a substring of the expected issuer. For example, if the expected issuer is "myapp-auth", set iss: "auth".
3. Re-sign the token (if signature key is known) or use the token as-is if signature is not verified (though signature verification is still performed, the iss check is bypassed).
4. Send the crafted token to the target.

Example Python script:

import jwt

# Assume we have a valid token or can sign with a known key
payload = {"sub": "user123", "iss": "auth"}  # substring of "myapp-auth"
key = "secret"
token = jwt.encode(payload, key, algorithm="HS256")
print(token)

Blue Team

Detection:

• Monitor for JWT tokens where the iss claim is a substring of the expected issuer.
• Log all JWT validation failures and inspect for patterns of substring iss values.

Mitigation:

• Upgrade to PyJWT 2.10.1 immediately.
• If upgrade is not possible, implement a custom validation wrapper that performs exact string comparison for iss.

Indicators of Compromise (IOCs)

• Network: JWT tokens with iss values that are substrings of expected issuers.
• Logs: InvalidIssuerError exceptions in PyJWT logs (though the vulnerability bypasses this error).
• File: Presence of PyJWT version 2.10.0 in requirements.txt or Pipfile.lock.

Detection Engineering

YARA Rule

rule CVE_2024_53861_PyJWT_Iss_Substring
{
    meta:
        description = "Detects PyJWT tokens with iss claim as substring of expected issuer"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2024-53861"
    strings:
        $iss_field = /"iss"\s*:\s*"[^"]*"/
    condition:
        $iss_field and #iss_field > 0
}

Sigma Rule

title: CVE-2024-53861 PyJWT Issuer Substring Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects JWT tokens with iss claim that is a substring of expected issuer
author: Valters IT
date: 2025-04-14
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 4625  # Example: failed authentication
        TokenIssuer|contains: "auth"  # Adjust based on expected issuer
    condition: selection
falsepositives:
    - Legitimate tokens with short issuer names
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53861 PyJWT Issuer Substring Bypass"; flow:to_server; content:"iss"; nocase; content:"\"auth\""; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade PyJWT to version 2.10.1 or later.
• Run pip install --upgrade pyjwt in all affected environments.

Compensating Controls:

• If upgrade is not possible, implement a custom validation function that performs exact string comparison for the iss claim before passing to PyJWT.
• Monitor for tokens with suspicious iss values.

Long-term:

• Review dependency update policies to ensure timely patching.
• Implement automated scanning for known CVEs in dependencies.

Valters IT