CVE-2023-52428

[mightymoogle]

Expected behavior

We expect no issues detected when .jar file is scanned with Sonatype Nexus. ApplicationInsights .jar file should include non-vulnerable library versions of Connect2id Nimbus JOSE+JWT (versions before 9.37.2 are vulnerable to CVE-2023-52428 according to https://nvd.nist.gov/vuln/detail/CVE-2023-52428).

Actual behavior

Our Sonatype Nexus detects CVE-2023-52428 in the ApplicationInsights .jar file (versions affected 3.2.0-BETA to latest 3.5.1) with root cause:
applicationinsights-agent-3.5.1.jarinst/com/nimbusds/jose/crypto/PasswordBasedDecrypter.classdata[4.0-rc1, 9.37.2)

Description from CVE

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Explanation

The nimbus-jose-jwt package is vulnerable to Denial of Service (DoS) attacks. The decrypt() method in the PasswordBasedDecrypter class fails to properly validate the length of the JWE p2c header. A remote attacker can exploit this vulnerability by supplying an oversized PBES2Count value, causing the application to consume all available resources and ultimately leading to a DoS condition.

To Reproduce

Perform a Sonatype Nexus scan on the ApplicationInsights .jar file or a Docker image file that includes the ApplicationInsights .jar file.

System information

Application Insights Java 3.5.1 (GA)

Logs

None applicable

Screenshots

[heyams]

@mightymoogle I understand your concern. However, that CVE hasn't listed the impacted version. I guess it's still under investigation?

[mightymoogle]

Hello @heyams , you are correct - the GitHub page indeed does not have an affected version explicitly specified and the NVD page has an "awaiting analysis" banner for a while. Yet the description states that versions before 9.37.2 are affected, which can be further seen in the fix for PasswordBasedDecrypter - https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/.

Vulnerability description at Sonatype

We also see other projects upgrading the libraries to fix the vulnerability:

microsoft-authentication-library-for-android
Wildfly

Whether you want to upgrade now or wait for the issue to be analyzed is fully up to you. We are not aware if the vulnerability actually affects ApplicationInsights directly.