Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in Perry's JWT validation that could allow unauthorized access by bypassing token expiration. Attackers in possession of a previously issued token can leverage this to maintain authenticated access indefinitely, even after a user logs out or an administrative revocation occurs. The main concern is confirming relevance and exposure to this specific JWT validation mechanism.
- Attackers can bypass token expiration.
- Retain authenticated access indefinitely.
- Confirm relevance and exposure of JWT validation.
Attack Path
How an attacker could exploit the issue
An attacker can bypass security controls by exploiting a flaw in how the system validates token expiration. This allows them to use old, previously issued tokens to maintain access indefinitely, even after actions like logging out or administrative revocation.
- No authentication required to attack.
- Attackers submit expired tokens.
- Persistent authenticated access.
Live Threat
Current exploitation, exposure, and threat context
A JWT validation vulnerability could allow attackers to bypass token expiration when supported by the advisory. This could result in indefinite authenticated access by presenting previously issued, expired tokens, circumventing expected session invalidation like user logouts or administrative revocations.
- Indefinite access to authenticated services.
- Expired tokens could be presented.
- Continued unauthorized access.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Perry's JWT validation impacts any system using it for authentication, potentially allowing attackers to bypass token expiration. Owners of applications and services relying on Perry for JWT verification are responsible for identifying affected instances, assessing their exposure and business criticality, and planning remediation.
- Application owners should own this issue.
- Verify token expiration bypass and reachability.
- Plan remediation based on risk assessment.
