CVE-2021-46743
📋 TL;DR
CVE-2021-46743 is an algorithm confusion vulnerability in Firebase PHP-JWT library that allows attackers to forge JWT tokens by exploiting key ID (kid) header mismatches when multiple key types are loaded. This enables authentication bypass and privilege escalation in applications using vulnerable versions. Any PHP application using firebase/php-jwt library with mixed key types is affected.
💻 Affected Systems
- firebase/php-jwt
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via admin privilege escalation, data exfiltration, and unauthorized access to all protected resources
Likely Case
Authentication bypass leading to unauthorized access to user accounts and protected API endpoints
If Mitigated
Limited impact with proper key validation and algorithm enforcement
🎯 Exploit Status
Exploitation requires knowledge of public key and ability to forge tokens
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.0 and later
Vendor Advisory: https://github.com/firebase/php-jwt/security/advisories/GHSA-5p8f-5jgv-5wq5
Restart Required: No
Instructions:
1. Update composer.json to require 'firebase/php-jwt: ^6.0.0' 2. Run 'composer update firebase/php-jwt' 3. Verify update with 'composer show firebase/php-jwt'
🔧 Temporary Workarounds
Enforce algorithm validation
allExplicitly validate algorithm in JWT verification to prevent confusion attacks
// PHP code: $decoded = JWT::decode($jwt, $key, ['RS256']); // Explicitly specify algorithm
Separate key rings
allUse separate key management for different algorithm types
// PHP code: Store RS256 and HS256 keys in separate arrays/objects
🧯 If You Can't Patch
- Implement strict algorithm validation in all JWT decode calls
- Use single algorithm type per application to avoid key confusion
🔍 How to Verify
Check if Vulnerable:
Check composer.lock or run 'composer show firebase/php-jwt' and verify version is below 6.0.0Check Version:
composer show firebase/php-jwt | grep versionVerify Fix Applied:
Confirm version is 6.0.0 or higher with 'composer show firebase/php-jwt | grep version'📡 Detection & Monitoring
Log Indicators:
- Failed JWT validations with algorithm mismatch errors
- Unexpected successful authentications with modified tokens
Network Indicators:
- JWT tokens with modified kid headers
- Authentication requests with unexpected algorithm types
SIEM Query:
source="application.logs" AND ("JWT validation failed" OR "algorithm mismatch")