CVE-2023-46943
📋 TL;DR
This vulnerability allows attackers to forge valid JSON Web Tokens (JWTs) due to a hardcoded weak HMAC secret ('secret') in @evershop/evershop. Attackers can use these forged tokens to gain unauthorized access to sensitive information and perform privileged actions within affected applications. Anyone using vulnerable versions of this NPM package is affected.
💻 Affected Systems
- @evershop/evershop
📦 What is this software?
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the application with administrative privileges, allowing data theft, account takeover, and full system control.
Likely Case
Unauthorized access to user accounts, sensitive data exposure, and privilege escalation within the application.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers, though the core vulnerability remains.
🎯 Exploit Status
Exploitation requires knowledge of JWT structure but is straightforward once the weak secret is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0-rc.8 and later
Vendor Advisory: https://advisory.checkmarx.net/advisory/CVE-2023-46943/
Restart Required: Yes
Instructions:
1. Update package.json to use @evershop/evershop version 1.0.0-rc.8 or higher. 2. Run 'npm update @evershop/evershop'. 3. Restart the application server. 4. Regenerate all existing JWTs with a new strong secret.
🔧 Temporary Workarounds
Manual HMAC Secret Replacement
allManually replace the hardcoded HMAC secret with a strong, unique value in the application configuration.
Edit configuration file to set a strong HMAC_SECRET environment variable
Restart application
🧯 If You Can't Patch
- Implement additional authentication layers (MFA, IP whitelisting)
- Monitor JWT usage patterns for anomalies and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check package.json for @evershop/evershop version. If version is below 1.0.0-rc.8, the system is vulnerable.Check Version:
npm list @evershop/evershopVerify Fix Applied:
Verify package.json shows @evershop/evershop version 1.0.0-rc.8 or higher and that HMAC secret is no longer 'secret'.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login with unusual patterns
- JWT validation errors or mismatched signatures
Network Indicators:
- Unusual API request patterns from unexpected locations
- Multiple authentication requests with similar JWT structures
SIEM Query:
source="application_logs" AND ("JWT" OR "token") AND ("invalid" OR "failed" OR "success") | stats count by src_ip, user