CVE-2023-40171
📋 TL;DR
This vulnerability in Dispatch's Basic Authentication Provider plugin exposes the JWT secret key in error messages when JWT token decoding fails. Attackers can use this secret to forge valid JWT tokens and take over any account in affected Dispatch instances. Only users who run their own Dispatch instances with the Basic Authentication Provider plugin enabled are impacted.
💻 Affected Systems
- Netflix Dispatch
📦 What is this software?
Dispatch by Netflix
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all user accounts in the Dispatch instance, allowing attackers to access sensitive incident data, modify configurations, and potentially pivot to other systems.
Likely Case
Attackers gain administrative access to the Dispatch instance, compromising security incident management data and potentially using the platform to launch further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Dispatch instance itself, though sensitive incident data would still be compromised.
🎯 Exploit Status
Exploitation requires triggering an error in JWT token decoding to obtain the secret, then using standard JWT libraries to forge tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20230817 release (commit b1942a4319)
Vendor Advisory: https://github.com/Netflix/dispatch/security/advisories/GHSA-fv3x-67q3-6pg7
Restart Required: Yes
Instructions:
1. Update Dispatch to version 20230817 or later. 2. Rotate the DISPATCH_JWT_SECRET environment variable. 3. Restart the Dispatch service.
🧯 If You Can't Patch
- Immediately rotate the DISPATCH_JWT_SECRET environment variable to a new random value
- Disable the Basic Authentication Provider plugin if not required
🔍 How to Verify
Check if Vulnerable:
Check if Dispatch version is older than 20230817 and Basic Authentication Provider plugin is enabledCheck Version:
Check Dispatch version in web interface or deployment configurationVerify Fix Applied:
Verify Dispatch version is 20230817 or newer and test that error messages no longer contain JWT secret📡 Detection & Monitoring
Log Indicators:
- Error messages containing JWT secret strings
- Multiple failed JWT decoding attempts from single source
Network Indicators:
- Unusual authentication patterns
- Requests designed to trigger JWT decoding errors
SIEM Query:
dispatch logs containing 'JWT' AND 'secret' OR 'key' in error messages🔗 References
- https://github.com/Netflix/dispatch/commit/b1942a4319f0de820d86b84a58ebc85398b97c70
- https://github.com/Netflix/dispatch/pull/3695
- https://github.com/Netflix/dispatch/releases/tag/latest
- https://github.com/Netflix/dispatch/security/advisories/GHSA-fv3x-67q3-6pg7
- https://github.com/Netflix/dispatch/commit/b1942a4319f0de820d86b84a58ebc85398b97c70
- https://github.com/Netflix/dispatch/pull/3695
- https://github.com/Netflix/dispatch/releases/tag/latest
- https://github.com/Netflix/dispatch/security/advisories/GHSA-fv3x-67q3-6pg7
